Edit tour

Windows Analysis Report
ePI4igo4y1.exe

Overview

General Information

Sample name:	ePI4igo4y1.exe renamed because original name is a hash value
Original sample name:	76935bfc6a1783ae507f5af7bb7a5691.exe
Analysis ID:	1432120
MD5:	76935bfc6a1783ae507f5af7bb7a5691
SHA1:	11de68dc07c94d552afaca0e3d9d5950ced39b3a
SHA256:	9cb9f9145a6ee0e02edeb9bc4def3214418342fe7e3a130ba8511a1c8ed77fcd
Tags:	32AsyncRATexetrojan
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AsyncRAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Found suspicious QR code URL

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Yara signature match

Classification

Process Tree

System is w10x64

ePI4igo4y1.exe (PID: 6808 cmdline: "C:\Users\user\Desktop\ePI4igo4y1.exe" MD5: 76935BFC6A1783AE507F5AF7BB7A5691)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,4947626736655423658,5044590235731121884,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Ports": ["3323"], "Server": ["94.156.128.246"], "Certificate": "MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJMk9aXYluIabmb8kV7b5XTizjGIK0IH5qWN260bNCSIKNt2zQOLq6jGfh+VvAA/ddzW3TGyxBUMbya8CatcEPCCiU4SEc8xjyE/n8+O0uya4p8g4ooTRIrNFHrRVySKchyTv32rce963WWvmj+qDvwUHHkEY+Dsjf46C40vWLDxAgMBAAGjMjAwMB0GA1UdDgQWBBQsonRhlv8vx7fdxs/nJE8fsLDixjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAVFFK4iQZ7aqDrUwV6nj3VoXFOcHVo+g9p9ikiXT8DjC2iQioCrN3cN4+w7YOkjPDL+fP3A7v+EI9z1lwEHgAqFPY7tF7sT9JEFtq/+XPM9bgDZnh4o1EWLq7Zdm66whSYsGIPR8wJdtjw6U396lrRHe6ODtIGB/JXyYYIdaVrz", "Server Signature": "Nqmv2wcVsrvOtblyG8sJBjCK4OtVpmu+0MeaEENdF0nNwRBS2ufhHl+dHxPk9rtPNZIeP4yX29qDlc6C3SBJna8aLLUbuTswGiGbzTvgG3Kof2hq3JsexjXflK9EnTPJtiN2AXv6Il0e00efLcWM2f3XJQg2DdfixbLC35+xB+s="}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ePI4igo4y1.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
ePI4igo4y1.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xf89c:$q1: Select * from Win32_CacheMemory 0xf8dc:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xf92a:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xf978:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: ePI4igo4y1.exe PID: 6808	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ePI4igo4y1.exe.6f0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.ePI4igo4y1.exe.6f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xf89c:$q1: Select * from Win32_CacheMemory 0xf8dc:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xf92a:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xf978:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}

Snort Signatures

ET TROJAN Observed Malicious SSL Cert (VenomRAT) - Source IP: 94.156.128.246 - Destination IP: 192.168.2.4

Timestamp:	04/26/24-14:27:05.915400
SID:	2052265
Source Port:	3323
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ePI4igo4y1.exe

Avira: detected

Found malware configuration

Source: ePI4igo4y1.exe

Malware Configuration Extractor: AsyncRAT {"Ports": ["3323"], "Server": ["94.156.128.246"], "Certificate": "MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJMk9aXYluIabmb8kV7b5XTizjGIK0IH5qWN260bNCSIKNt2zQOLq6jGfh+VvAA/ddzW3TGyxBUMbya8CatcEPCCiU4SEc8xjyE/n8+O0uya4p8g4ooTRIrNFHrRVySKchyTv32rce963WWvmj+qDvwUHHkEY+Dsjf46C40vWLDxAgMBAAGjMjAwMB0GA1UdDgQWBBQsonRhlv8vx7fdxs/nJE8fsLDixjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAVFFK4iQZ7aqDrUwV6nj3VoXFOcHVo+g9p9ikiXT8DjC2iQioCrN3cN4+w7YOkjPDL+fP3A7v+EI9z1lwEHgAqFPY7tF7sT9JEFtq/+XPM9bgDZnh4o1EWLq7Zdm66whSYsGIPR8wJdtjw6U396lrRHe6ODtIGB/JXyYYIdaVrz", "Server Signature": "Nqmv2wcVsrvOtblyG8sJBjCK4OtVpmu+0MeaEENdF0nNwRBS2ufhHl+dHxPk9rtPNZIeP4yX29qDlc6C3SBJna8aLLUbuTswGiGbzTvgG3Kof2hq3JsexjXflK9EnTPJtiN2AXv6Il0e00efLcWM2f3XJQg2DdfixbLC35+xB+s="}

Multi AV Scanner detection for submitted file

Source: ePI4igo4y1.exe	ReversingLabs: Detection: 76%
Source: ePI4igo4y1.exe	Virustotal: Detection: 75%			Perma Link

Machine Learning detection for sample

Source: ePI4igo4y1.exe

Joe Sandbox ML: detected

Phishing

Found suspicious QR code URL

Source: QR Code extractor	URL: http://
Source: QR Code extractor	URL: http://
Source: QR Code extractor	URL: 439391902758926017610517255313142298274480438044440121118994274987582850918190225834287726796126916145629914721733522710987616657314017765228865740646039848432710886743079548303442292437255394730948145864446775953265103441173709868657701742473083641111846265878297930501228044440623708994274155610283273472685443265118076120507592582475581488374897107878413328648070843912630936634157
Source: QR Code extractor	URL: 439391902758926017610517255313142298274480438044440121118994274987582850918190225834287726796126916145629914721733522710987616657314017765228865740646039848432710886743079548303442292437255394730948145864446775953265103441173709868657701742473083641111846265878297930501228044440623708994274155610283273472685443265118076120507592582475581488374897107878413328648070843912630936634157

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.67:443 -> 192.168.2.4:49758 version: TLS 1.2

Source: ePI4igo4y1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2052265 ET TROJAN Observed Malicious SSL Cert (VenomRAT) 94.156.128.246:3323 -> 192.168.2.4:49730

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 94.156.128.246:3323

Source: global traffic

HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: */*APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1714134708629Host: self.events.data.microsoft.comContent-Length: 7976Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: BELCLOUDBG BELCLOUDBG

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.128.246

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGJu7rrEGIjAoqyexFOGLbT8aLOaA_R2zVcAlbcD7V11k6B8b8yEPzaS9F1blMUQnJ9DYpXZ_bH4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=ajmUOexKwGMh0AvseEoWnqvqvcnjinuBPSdrVSftflPccZwEDAhTnWaTaY0UcGkJWJwwLniKDkt6ugI1rLHDeVR4Ks1DuZUZDuWm9lIyv24LXQCiHULnjblafcAxqSR7bwKUIInEF3BIYHF7fOTdyu4xbWUfEWcX0pr572m3BSY
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGJu7rrEGIjDDcv02CuPdWY5ubddYolN9oRq8ljClcTTSomnqqiNV12SKZZRW_Od0MHXrWW8249YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=ajmUOexKwGMh0AvseEoWnqvqvcnjinuBPSdrVSftflPccZwEDAhTnWaTaY0UcGkJWJwwLniKDkt6ugI1rLHDeVR4Ks1DuZUZDuWm9lIyv24LXQCiHULnjblafcAxqSR7bwKUIInEF3BIYHF7fOTdyu4xbWUfEWcX0pr572m3BSY
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E+L9AauZ856Cb3R&MD=8gCfUGcc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E+L9AauZ856Cb3R&MD=8gCfUGcc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

Source: 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: tmp8876.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tmp8876.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: tmp8876.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tmp8876.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: places.raw.0.dr, tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.raw.0.dr, tmp8A4E.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.67:443 -> 192.168.2.4:49758 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: ePI4igo4y1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ePI4igo4y1.exe PID: 6808, type: MEMORYSTR

Contains functionality to log keystrokes (.Net Source)

Source: ePI4igo4y1.exe, Keylogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: ePI4igo4y1.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen

Source: ePI4igo4y1.exe, 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs ePI4igo4y1.exe
Source: ePI4igo4y1.exe	Binary or memory string: OriginalFilenameClientAny.exe" vs ePI4igo4y1.exe

Source: ePI4igo4y1.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI

Source: ePI4igo4y1.exe, Settings.cs

Base64 encoded string: 'QFJhPLgtKAYj87j1RSbCi7457Eerjv5kX0vQpvlTFpq+JXUD4tpy/ItrkMUITi/KJk5vTnhAHgfoFks++dJnAA==', 'vtOx+iCLD+JTIjYNnRhR3P8c1/P8ql3gO84za1eAD36+0/5VuKjFDuxUp/EnClfSio2tzTzGToGfdvJI+j9N3w==', 'Rxv11xqYRSU671YgnMqPGXZIj/1uhwJElyPx3QRAf24RlH/rJeDTqlqJ3EerWRxASL6UM2WvY8sSH+9OKlA2sg==', 'V1MoP38pI2VkZx9VSy0IQJecq/pqz9PrqiWjhSlpGRw5Vf7uWxrtAtdkw509em6tGb4e7jvqVqQdoObNQG6o8ysGHOdrUIC34AzGaNG3IU8=', 'zGyBu+3tDn1XY2phASQ5NLGEL6iNd6goB1MQqoBVHMbLFCxmGf07itws4E2D2G37jy4LjIJxFw6sdLXqlEoO+Q5aia2J1RuxCdBRedScBbc15FexR66JZF6u99ZDQB3odphiO2lo6dfq6PAVXdu2HTvgPFB4QoM2CIVIMyOesA1BYOA23i+/bVK47z31IQ7DYNmQO5hn+Phm9sXgVOPEI35kbwAlvEqxfNHyQGI1eQfwwlp4SaQDj+e3Tnu5tCOFQf+Vx1xnlA+4mKi387CsRK3RSVRvy8mS4S8Xy6E+JeM=', 'HQqfqju2rXY5+8M9liB04ye/XqBOgqtehyBeH1KQShhq3bDDs/saicSZ2qWJZI25G6P6L6iXSw/4mpA8haentQ==', 'hn57Sj9G8FikFnOIKdmovP/H+RMklvUYoWUU1Q7PWmbSfewWLWzKzp4j6V1BEQQ/zZgtqzBlgyvvKxsAfeqT9w==', 'nOjJ0IYbmXFewa+4w4iSn+K1WE0qhdgLFHNlLjMQbvPd7/WUBEORc+9mJaGpHmyJ0VLdvMVwnFw6r13EnTZ3Wg==', 'g3NashaO27Eb8YpILukPQTwQwLMb1cCX9a9jO/tSqV1QDLGCI05aVgoBey/EizAvOBMM+COSFstqKF6R5pT3lQ=='

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@16/14@2/4

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

File created: C:\Users\user\AppData\Roaming\MyData

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Mutant created: \Sessions\1\BaseNamedObjects\dhhtyh7D3j798D3JY73DJ

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8834.tmp

Jump to behavior

Source: ePI4igo4y1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ePI4igo4y1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp8864.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ePI4igo4y1.exe	ReversingLabs: Detection: 76%
Source: ePI4igo4y1.exe	Virustotal: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\ePI4igo4y1.exe "C:\Users\user\Desktop\ePI4igo4y1.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,4947626736655423658,5044590235731121884,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,4947626736655423658,5044590235731121884,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: ePI4igo4y1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ePI4igo4y1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: ePI4igo4y1.exe, ClientSocket.cs

.Net Code: Invoke System.AppDomain.Load(byte[])

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: ePI4igo4y1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ePI4igo4y1.exe PID: 6808, type: MEMORYSTR

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\4C67EC226C1C2FB3C434 BEA19E2DECE602CED1D3DF8C825A993F3D412C2A4D4D87EAA39F44BA4FB39E82

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: ePI4igo4y1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ePI4igo4y1.exe PID: 6808, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ePI4igo4y1.exe

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Memory allocated: C40000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Memory allocated: 1A9E0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Window / User API: threadDelayed 654			Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Window / User API: threadDelayed 9189			Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe TID: 7632	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe TID: 7888	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe TID: 7896	Thread sleep count: 654 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe TID: 7896	Thread sleep count: 9189 > 30	Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ePI4igo4y1.exe, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: ePI4igo4y1.exe, DInvokeCore.cs	Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: ePI4igo4y1.exe, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Queries volume information: C:\Users\user\Desktop\ePI4igo4y1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: ePI4igo4y1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ePI4igo4y1.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ePI4igo4y1.exe PID: 6808, type: MEMORYSTR

Source: ePI4igo4y1.exe, 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MSASCui.exe
Source: ePI4igo4y1.exe, 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: procexp.exe
Source: ePI4igo4y1.exe, 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\ePI4igo4y1.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ePI4igo4y1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	1 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Modify Registry	1 Input Capture	24 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	151 Virtualization/Sandbox Evasion	NTDS	151 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ePI4igo4y1.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
ePI4igo4y1.exe	75%	Virustotal		Browse
ePI4igo4y1.exe	100%	Avira	HEUR/AGEN.1307453
ePI4igo4y1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.64.196	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGJu7rrEGIjDDcv02CuPdWY5ubddYolN9oRq8ljClcTTSomnqqiNV12SKZZRW_Od0MHXrWW8249YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGJu7rrEGIjAoqyexFOGLbT8aLOaA_R2zVcAlbcD7V11k6B8b8yEPzaS9F1blMUQnJ9DYpXZ_bH4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://duckduckgo.com/chrome_newtab	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp8A4E.tmp.dat.0.dr	false	high
https://duckduckgo.com/ac/?q=	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tmp8876.tmp.dat.0.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://support.mozilla.org	tmp8A4E.tmp.dat.0.dr	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	tmp8876.tmp.dat.0.dr	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tmp8876.tmp.dat.0.dr	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	tmp8876.tmp.dat.0.dr	false	high
https://www.ecosia.org/newtab/	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp8896.tmp.dat.0.dr, tmp8834.tmp.dat.0.dr	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp8A4E.tmp.dat.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
94.156.128.246	unknown	Bulgaria	44901	BELCLOUDBG	true

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432120
Start date and time:	2024-04-26 14:26:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	ePI4igo4y1.exe renamed because original name is a hash value
Original Sample Name:	76935bfc6a1783ae507f5af7bb7a5691.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@16/14@2/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.35, 142.250.189.142, 173.194.210.84, 199.232.210.172, 34.104.35.123, 23.45.182.93, 23.45.182.68, 23.45.182.104, 23.45.182.97, 192.229.211.108, 172.217.165.195, 142.250.217.238
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, self.events.data.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:27:08	API Interceptor	38852139x Sleep call for process: ePI4igo4y1.exe modified

QR Codes

Source	URL
Screenshot	http://
Screenshot	439391902758926017610517255313142298274480438044440121118994274987582850918190225834287726796126916145629914721733522710987616657314017765228865740646039848432710886743079548303442292437255394730948145864446775953265103441173709868657701742473083641111846265878297930501228044440623708994274155610283273472685443265118076120507592582475581488374897107878413328648070843912630936634157

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	POattach.html	Get hash	malicious	HTMLPhisher	Browse
	http://www.ensp.fiocruz.br/portal-ensp/entrevista/counter.php?content=http://owens-minor.com&contentid=32190&link=https://nabbeton.com/!	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse
	https://exploredrinks.com	Get hash	malicious	Unknown	Browse
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse
	https://survey.zohopublic.eu/zs/GzDXvp	Get hash	malicious	HTMLPhisher	Browse
	https://ipfs.io/ipfs/QmTvMGRn6QMQAMwSucv8UUTX3cyS4DrLuUTMvDui8TsJNN	Get hash	malicious	Unknown	Browse
	https://deebmpapst.ordineproposal.top/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	http://www.ensp.fiocruz.br/portal-ensp/entrevista/counter.php?content=http://owens-minor.com&contentid=32190&link=https://nabbeton.com/!	Get hash	malicious	Unknown	Browse	199.232.210.172
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	199.232.214.172
	https://survey.zohopublic.eu/zs/GzDXvp	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Serbia_Vendor_Creation_1.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://powerpointmicrosoftoffice.top/	Get hash	malicious	Unknown	Browse	199.232.214.172
	Quotation Order.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	Payment.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://cnmxukx5efilc7lvlel.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELCLOUDBG	OA32chYJ8O.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	6aG1a8blIn.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	wslsrv.dll.dll	Get hash	malicious	Unknown	Browse	88.80.148.65
	wslsrv.dll.dll	Get hash	malicious	Unknown	Browse	88.80.148.65
	SecuriteInfo.com.Trojan.Win32.Crypt.13043.16981.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	SecuriteInfo.com.Trojan.Win32.Crypt.28283.2949.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	SecuriteInfo.com.Trojan.Win32.Crypt.19930.13722.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	SecuriteInfo.com.Trojan.Win32.Crypt.9045.18959.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	cqWhR7xBPu.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	Jk5mjxD132.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	POattach.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	http://www.ensp.fiocruz.br/portal-ensp/entrevista/counter.php?content=http://owens-minor.com&contentid=32190&link=https://nabbeton.com/!	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	https://exploredrinks.com	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	13.85.23.86 23.193.120.112
	https://survey.zohopublic.eu/zs/GzDXvp	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	13.85.23.86 23.193.120.112
	https://ipfs.io/ipfs/QmTvMGRn6QMQAMwSucv8UUTX3cyS4DrLuUTMvDui8TsJNN	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	RisePro Stealer	Browse	52.168.112.67
	file.exe	Get hash	malicious	RisePro Stealer	Browse	52.168.112.67
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	52.168.112.67
	https://therufus.org/download.php	Get hash	malicious	Unknown	Browse	52.168.112.67
	j1zkOQTx4q.exe	Get hash	malicious	RisePro Stealer	Browse	52.168.112.67
	VoGtelkHSn.exe	Get hash	malicious	LummaC	Browse	52.168.112.67
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	52.168.112.67
	file.exe	Get hash	malicious	RisePro Stealer	Browse	52.168.112.67
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	52.168.112.67
	SecuriteInfo.com.Win32.Evo-gen.19638.13648.exe	Get hash	malicious	DBatLoader	Browse	52.168.112.67

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.236117150252365
Encrypted:	false
SSDEEP:	6:kK/7kVlEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:wVlbkPlE99SNxAhUeVLVt
MD5:	3DF44F6CF2B6C63AAE04DB0A7D3FBD09
SHA1:	CFC7161FD2E9276DEBDCB71E739811FC6F9D88B6
SHA-256:	E94A212FF6DCFA27B993C3BE31AC018A53CB140989454FAA6FFF5895F0F3D50B
SHA-512:	62BBF7AC38FBFC1EEF02A1201B38B1F1D59C8657E777FC0E4E9F346B55292DE73D42C225444518585272C0DCA26B44D4877821FD404F953A850C8C2FBFBC95A1
Malicious:	false
Reputation:	low
Preview:	p...... ........\......(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8834.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8864.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8876.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8896.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A2D.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A4E.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8B39.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8B4A.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8B4B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8B5B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

Download File

Process:	C:\Users\user\Desktop\ePI4igo4y1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:Rt:v
MD5:	CF759E4C5F14FE3EEC41B87ED756CEA8
SHA1:	C27C796BB3C2FAC929359563676F4BA1FFADA1F5
SHA-256:	C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
SHA-512:	C7F832AEE13A5EB36D145F35D4464374A9E12FA2017F3C2257442D67483B35A55ECCAE7F7729243350125B37033E075EFBC2303839FD86B81B9B4DCA3626953B
Malicious:	false
Preview:	.5.False

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.803781977742739
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ePI4igo4y1.exe
File size:	75'776 bytes
MD5:	76935bfc6a1783ae507f5af7bb7a5691
SHA1:	11de68dc07c94d552afaca0e3d9d5950ced39b3a
SHA256:	9cb9f9145a6ee0e02edeb9bc4def3214418342fe7e3a130ba8511a1c8ed77fcd
SHA512:	9d0fd776fa65503a543af943868d3135392f7b1ee8f4c026e344103761f205c908c74e283d42845bcb5401e90da2a747c4f2c856f1a740b3608824dcc2a29f46
SSDEEP:	1536:jUEkcx4VHsC0SPMV/BBQA4OIcE1bj/CxQzcqLVclN:jUxcx4GfSPMV/7QA1E1bjqxQbBY
TLSH:	CE734A013BE8CD25E2AE4BB9ACF251074EF4D5576512CE5E3CC840CE5A67BC58A037EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c............................^4... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41345e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63E41DD4 [Wed Feb 8 22:10:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13410	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0xdf7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11464	0x11600	5bbe928d1fbd48d17218b7a15ea78602	False	0.48254833633093525	data	5.8311230162113485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0xdf7	0xe00	50d51c0d62880c66f3cf5bb9b910b038	False	0.40318080357142855	data	5.114037721217549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	780e3bcdb174aad66ac77e5e835a9fad	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x2d4	data			0.4447513812154696
RT_MANIFEST	0x14374	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40245261984392416

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-14:27:05.915400	TCP	2052265	ET TROJAN Observed Malicious SSL Cert (VenomRAT)	3323	49730	94.156.128.246	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:26:56.013736963 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 14:27:05.308095932 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:05.574552059 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:05.574790955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:05.623100042 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 14:27:05.648838997 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:05.915400028 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:05.922832012 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:06.190180063 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:06.303703070 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:06.957484007 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.957525969 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.957601070 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958101988 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958133936 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.958250999 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958271980 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.958280087 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958314896 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958364964 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.958374977 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.958416939 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.960000992 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.960011005 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.960370064 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.960381985 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.960542917 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.960556030 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:06.960686922 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:06.960701942 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.293867111 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.294723034 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.294745922 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.296158075 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.296226025 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.296899080 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.299364090 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.299420118 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.299860001 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.299875021 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.301165104 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.301217079 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.303575039 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.303582907 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.304646969 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.304716110 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.304771900 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.304778099 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.348495007 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.349509954 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.349519014 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.350387096 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.350450993 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.351093054 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.351150990 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.352016926 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.352025032 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.354258060 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.354593992 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.354604006 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.357955933 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.358016014 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.360377073 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.360462904 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.360485077 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.408117056 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.410923958 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.410932064 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.418952942 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.418958902 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.418960094 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.457248926 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.651922941 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.652018070 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.652092934 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.652101040 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.652165890 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.652228117 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.656295061 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.656364918 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.656379938 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.660826921 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.661302090 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.958420992 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.958492041 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:07.958571911 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.958764076 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:07.958817959 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.042061090 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.042134047 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.042152882 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.042193890 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.042243958 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.216903925 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.216998100 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.217012882 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.217024088 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:08.217078924 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.923724890 CEST	49734	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:08.923732996 CEST	443	49734	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.062170029 CEST	49732	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.062213898 CEST	443	49732	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.062813044 CEST	49733	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.062834978 CEST	443	49733	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.152836084 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.152873039 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.152941942 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.153203011 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.153218031 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.153954983 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.153996944 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.154052973 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.154284954 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.154299974 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.155874014 CEST	49731	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.155927896 CEST	443	49731	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.478002071 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.478787899 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.478800058 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.479275942 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.479772091 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.479851007 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.480705976 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.486927986 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.488306046 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.488323927 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.488871098 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.498280048 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.498481035 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.511538982 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.528120041 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.556114912 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.805660963 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.805712938 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.805742979 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.805761099 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.805785894 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.805828094 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.806231022 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.806284904 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.806325912 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.812902927 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.812916994 CEST	443	49739	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.812931061 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.812968969 CEST	49739	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.827863932 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.827919006 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.827945948 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.827958107 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.827971935 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.828005075 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.828133106 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.828187943 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:09.828237057 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.863394022 CEST	49740	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:09.863431931 CEST	443	49740	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:10.118004084 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:10.424164057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:10.424233913 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:10.744199038 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:10.860014915 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:10.860058069 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:10.860133886 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:10.860630989 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:10.860644102 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:11.187722921 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:11.188075066 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:11.188086033 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:11.188546896 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:11.189137936 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:11.189210892 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:11.233119011 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:14.125327110 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:14.168754101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:14.435345888 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:14.451122046 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:14.758292913 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:14.758361101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.065439939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124120951 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124176025 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124222040 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.124236107 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124299049 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124316931 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124337912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.124402046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124440908 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.124608994 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124663115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124699116 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.124718904 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124753952 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.124794960 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.125065088 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.168561935 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.400649071 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400671005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400706053 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400790930 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.400839090 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400856972 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400873899 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400878906 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.400895119 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.400908947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.401365995 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.401402950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.401418924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.401479959 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.401499033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.401514053 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.403245926 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403264999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403301001 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.403317928 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403353930 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403354883 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.403374910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403393030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403409004 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.403429031 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403448105 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.403475046 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.445525885 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.447264910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.447288990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.447343111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667229891 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667254925 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667371035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667429924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667448997 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667467117 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667484999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667495012 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667503119 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667531013 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667546988 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667565107 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667583942 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667599916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667602062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667620897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667629957 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667651892 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667711020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667743921 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667768002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667778015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667843103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667860985 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667896032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667898893 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667932034 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667939901 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.667963982 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.667999983 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669567108 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669588089 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669603109 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669621944 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669631958 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669646025 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669656992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669775963 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669811010 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669832945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669850111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669867992 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669877052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669893980 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.669902086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669923067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.669990063 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.670010090 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.670027018 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.670028925 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.670046091 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.670062065 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.670063972 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.670099974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.712219954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.714127064 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.714164972 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.714188099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.755260944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.933971882 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934029102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934067011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934088945 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934104919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934142113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934146881 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934178114 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934214115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934216022 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934251070 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934287071 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934288979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934323072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934357882 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934365034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934395075 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934429884 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934432030 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934468031 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934505939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934509039 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934541941 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934581995 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934595108 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934629917 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934664965 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934665918 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.934699059 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934736967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.934740067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936063051 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936108112 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936120033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936161995 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936201096 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936222076 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936273098 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936315060 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936315060 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936353922 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936391115 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936391115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936429024 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936465025 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936465979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936501980 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936537981 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936541080 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936573982 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936609030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936614037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.936645985 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936681032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.936683893 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:15.980763912 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.980788946 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:15.980868101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:16.021780968 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.072285891 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:16.201586008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.201801062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.201853037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:16.201864958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.201920986 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.201960087 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:16.201997995 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.202081919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.202120066 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:16.202142954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.202183008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:16.202218056 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.580297947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.748392105 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:18.748430014 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:18.748506069 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:18.810844898 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:18.810862064 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:18.846853971 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.846889973 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.846944094 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.846944094 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847047091 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847086906 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847105980 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847179890 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847218990 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847245932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847366095 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847398043 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847453117 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847522974 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847568989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847594976 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847666025 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847702026 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847711086 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847781897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847820044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847847939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847889900 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.847932100 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.847970963 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848051071 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848083973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848129988 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848181009 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848222017 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848234892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848301888 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848341942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848368883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848418951 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848455906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848460913 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848536968 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848573923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848597050 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848639011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848700047 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848700047 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848764896 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848797083 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848813057 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848860025 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848898888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.848900080 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.848985910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.849021912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.849076986 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.849117041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.849147081 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.849154949 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.849214077 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.849255085 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:18.849260092 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:18.989758968 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.070286036 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.070364952 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.074878931 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.074888945 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.075160027 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.113401890 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.113617897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.113691092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.113704920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.113786936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.113926888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.114223957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114367962 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114423037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.114589930 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114674091 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114715099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.114742041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114804029 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114854097 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.114875078 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114892960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.114937067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.114974976 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115050077 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115091085 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.115128040 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115201950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115240097 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.115293980 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115324974 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115369081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.115385056 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115426064 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115461111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115473986 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.115528107 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115571976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.115864038 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115912914 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.115952015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.116018057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116132975 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116173029 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.116249084 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116581917 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116627932 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.116658926 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116734028 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116775036 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.116866112 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116942883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.116986990 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.117070913 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117173910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117192030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117233038 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.117245913 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117291927 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.117327929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117408991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.117444992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.117487907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.124154091 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.168149948 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.256215096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.256277084 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.318665028 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.318747997 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.318800926 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.318887949 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.318905115 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.318917036 CEST	49746	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.318922043 CEST	443	49746	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.380228996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.380275011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.380320072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.380325079 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.380382061 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.380424023 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.380986929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381016016 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381063938 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.381254911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381328106 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381367922 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.381401062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381508112 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381546021 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.381597996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381848097 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.381886959 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.381947041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382067919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382105112 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.382155895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382246017 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382283926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.382345915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382381916 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382422924 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.382482052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382539988 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382576942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.382632971 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382710934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382750034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.382908106 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382942915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.382981062 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.383023977 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383102894 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383141994 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.383177996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383224010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383263111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.383373022 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383480072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383516073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.383569002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383615017 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.383655071 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.383898020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384006977 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384042025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.384078979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384129047 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384169102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.384186029 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384243011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.384282112 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.389851093 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.389863014 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.389925957 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.390351057 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.390362024 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.522780895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.522901058 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.522948027 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.604710102 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:19.604738951 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:19.604810953 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:19.606235981 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:19.606251955 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:19.646507978 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.646583080 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.646758080 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.646931887 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.646971941 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.647005081 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.647058010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.647128105 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.647563934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.647650003 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.647751093 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.647783041 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.647809982 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.648061991 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.648400068 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648453951 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648502111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648505926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.648590088 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648659945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648746014 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.648762941 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648802042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.648828030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.648974895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649040937 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649056911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.649070978 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.649091005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649153948 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.649234056 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649281979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649346113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649359941 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.649502039 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649652004 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649660110 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.649674892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649724960 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.649733067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649794102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649838924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.649864912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.650062084 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650132895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650139093 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.650196075 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650233984 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.650279999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650350094 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650404930 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650404930 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.650701046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.650760889 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.650870085 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.651011944 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.651048899 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.651089907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.651130915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.651170015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.651199102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.692138910 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.700645924 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.789350033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.789446115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.789678097 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.914489031 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914513111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914570093 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.914628983 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914712906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914730072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914771080 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.914798975 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.914839983 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.914973021 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.915545940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.915648937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.915724993 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.915791035 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.915836096 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.916274071 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916349888 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916389942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.916433096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916511059 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916528940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916553020 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.916589975 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916636944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.916673899 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916734934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916798115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916816950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.916951895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.916999102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.917016029 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917157888 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917212009 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.917248011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917339087 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917399883 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.917534113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917614937 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917674065 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.917746067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917819023 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.917865038 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.917975903 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918066978 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918108940 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.918159962 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918273926 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918317080 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.918436050 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918519020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918593884 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918605089 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.918740034 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918802023 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.918827057 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:19.961596966 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.961726904 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.961796045 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.962594032 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.962594986 CEST	49747	443	192.168.2.4	23.193.120.112
Apr 26, 2024 14:27:19.962651968 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.962678909 CEST	443	49747	23.193.120.112	192.168.2.4
Apr 26, 2024 14:27:19.967364073 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:19.967423916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:20.056129932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:20.056226969 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:20.056464911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:20.101377010 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.101787090 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.104543924 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.104564905 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.104976892 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.181288958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:20.316118002 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.316235065 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.403016090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:20.592070103 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.601150990 CEST	49723	80	192.168.2.4	72.21.81.240
Apr 26, 2024 14:27:20.634897947 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:20.634953976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:20.636130095 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.725852013 CEST	80	49723	72.21.81.240	192.168.2.4
Apr 26, 2024 14:27:20.726566076 CEST	49723	80	192.168.2.4	72.21.81.240
Apr 26, 2024 14:27:20.910936117 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.910969973 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.910989046 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.911144018 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.911144018 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.911201954 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.911299944 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.924319983 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.924354076 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:20.924396038 CEST	49748	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:20.924411058 CEST	443	49748	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:21.179538965 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:21.179615021 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:21.179666042 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:21.515490055 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:27:21.515517950 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 14:27:21.969254017 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:21.969748974 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:22.236897945 CEST	3323	49753	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:22.236972094 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:22.237595081 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:22.276043892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:22.276108980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:22.503746033 CEST	3323	49753	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:22.504333973 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:22.582847118 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:22.810484886 CEST	3323	49753	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:24.497509003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:24.805151939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:24.805284977 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.071901083 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:25.189623117 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.380868912 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:25.380944014 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.383968115 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.463120937 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:25.463188887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.657002926 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.690386057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:25.690445900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.963598013 CEST	3323	49753	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:25.963664055 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:25.997735977 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:26.232624054 CEST	3323	49753	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:26.240773916 CEST	49753	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:38.876506090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:39.181876898 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:39.181941986 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:39.448529959 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:39.497463942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:39.749320030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:39.749399900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:39.753748894 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:39.764010906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:39.764059067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:40.060461044 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:40.060539961 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:40.367732048 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:53.033344030 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:53.339402914 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:53.339456081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:53.607553005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:53.652801037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:53.905649900 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:53.905759096 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:53.907331944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:53.919852018 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:53.919914961 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:54.213927984 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:54.214076042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:54.574682951 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:27:54.841057062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:27:59.282085896 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.282114983 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:59.282187939 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.282671928 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.282686949 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:59.768536091 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:59.768621922 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.772875071 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.772887945 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:59.773092031 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:27:59.781629086 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:27:59.828111887 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.253375053 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.253401995 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.253437042 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.253496885 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.253524065 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.253537893 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.253577948 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.255918980 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.255961895 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.255986929 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.256036043 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.256062984 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.257940054 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.257956982 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:00.257966995 CEST	49754	443	192.168.2.4	13.85.23.86
Apr 26, 2024 14:28:00.257971048 CEST	443	49754	13.85.23.86	192.168.2.4
Apr 26, 2024 14:28:08.043257952 CEST	49724	80	192.168.2.4	72.21.81.240
Apr 26, 2024 14:28:08.047792912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:08.167613029 CEST	80	49724	72.21.81.240	192.168.2.4
Apr 26, 2024 14:28:08.167690039 CEST	49724	80	192.168.2.4	72.21.81.240
Apr 26, 2024 14:28:08.353794098 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:08.353859901 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:08.620743990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:08.674596071 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:08.921185017 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:08.921257973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:08.923584938 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:08.941905022 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:08.941987038 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:09.229367971 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:09.229438066 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:09.535713911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:10.920418978 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:10.920475006 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:10.920557976 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:10.920789957 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:10.920821905 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:11.268793106 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:11.269052982 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:11.269072056 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:11.269417048 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:11.269725084 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:11.269798994 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:11.325098038 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:21.248285055 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:21.248379946 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:21.248435974 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:21.521671057 CEST	49756	443	192.168.2.4	142.250.64.196
Apr 26, 2024 14:28:21.521708965 CEST	443	49756	142.250.64.196	192.168.2.4
Apr 26, 2024 14:28:22.200598955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:22.507334948 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:22.509123087 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:22.865879059 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:23.146764994 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:23.187772989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:23.433315039 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:23.433484077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:23.435890913 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:23.454680920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:23.454823971 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:23.758368969 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:23.758631945 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.064569950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:24.064933062 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.347929001 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:24.388798952 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.646127939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:24.646213055 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.648235083 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.655147076 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:24.655261993 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:24.957175016 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:24.957285881 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:25.263745070 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:28.497811079 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:28.805095911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:28.805164099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:29.081243992 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:29.125590086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:29.378725052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:29.378828049 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:29.380542040 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:29.395394087 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:29.397609949 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:29.693650007 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:29.693929911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:30.001916885 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:40.580815077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:40.886904955 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:40.886974096 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:41.179811001 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:41.231650114 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:41.455066919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:41.455879927 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:41.458478928 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:41.498637915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:41.498879910 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:41.767126083 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:41.767934084 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:42.074539900 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:54.732451916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.065212011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:55.065298080 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.332117081 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:55.416708946 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.650166988 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:55.650330067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.651611090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.683470964 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:55.683692932 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:55.959863901 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:28:55.959984064 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:28:56.279531002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:01.544455051 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:01.851841927 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:01.851954937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:02.118726969 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:02.216500044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:02.419255972 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:02.419336081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:02.421164989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:02.483465910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:02.483521938 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:02.728086948 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:02.728142023 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.006089926 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:03.207962036 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.295330048 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:03.297048092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.298691988 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.495242119 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:03.498188019 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.605771065 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:03.605896950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:03.912014008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:12.846606970 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.153379917 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:13.153472900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.427438974 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:13.485006094 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.576448917 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.734365940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:13.734468937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.734468937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.751858950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:13.751934052 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:13.897547960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:13.900650024 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:14.001262903 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:14.059968948 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:14.170689106 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:14.175065041 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:14.301155090 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:14.301198959 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:14.481229067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:14.481285095 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:14.787456989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:19.654516935 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:19.964837074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:19.965759039 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:20.233377934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:20.278443098 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:20.535517931 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:20.535605907 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:20.537564993 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:20.544959068 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:20.545005083 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:20.846489906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:20.846575022 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:21.172877073 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:23.702358007 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.023056984 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:24.026565075 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.295694113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:24.341533899 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.594702959 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:24.594780922 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.596581936 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.608035088 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:24.608078957 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:24.902951002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:24.903031111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:25.213291883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:29.420007944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:29.743294954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:29.747818947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:30.014750957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:30.122736931 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:30.314790010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:30.314863920 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:30.389566898 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:30.389621973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:30.871814966 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:31.178571939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:31.178632021 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:31.487932920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:40.513217926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:40.820565939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:40.820691109 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:41.087444067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:41.137413979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:41.389283895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:41.389360905 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:41.391258001 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:41.403911114 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:41.403958082 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:41.699008942 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:41.699069977 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:42.006295919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:44.169687033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:44.476253986 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:44.476533890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:44.743345022 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:44.934727907 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:45.042845964 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:45.042973042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:45.046571016 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:45.205168962 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:45.208641052 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:45.354542971 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:45.354662895 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:45.661185026 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:49.531747103 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:49.853349924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:49.853411913 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:50.121798992 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:50.234447956 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:50.425431967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:50.425548077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:50.426795006 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:50.500969887 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:50.501138926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:50.735703945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:50.736711025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:51.064138889 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:58.594583035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:58.921653032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:58.921770096 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:59.189382076 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:59.368313074 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:59.488730907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:59.488796949 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:59.492113113 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:29:59.800242901 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:29:59.800334930 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:00.107553959 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:12.754616022 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.061333895 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:13.061386108 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.327902079 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:13.437242031 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.651283979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:13.651377916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.652733088 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.704202890 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:13.704302073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:13.970396996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:13.970520020 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:14.276810884 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:14.920092106 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:15.231602907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:15.231666088 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:15.498286009 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:15.688996077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:15.799160957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:15.799892902 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:15.802654982 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:15.958340883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:15.958659887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:16.109194040 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:16.110678911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:16.417689085 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:18.110903978 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:18.417134047 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:18.417188883 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:18.695589066 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:18.742706060 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:18.983989954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:18.984061956 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:18.985692024 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:19.014539957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:19.014605045 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:19.308743954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:19.308804989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:19.615792990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:32.983042955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:33.295655966 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:33.299196959 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:33.565856934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:33.670139074 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:33.865494967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:33.865556955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:33.867018938 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:33.938884020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:33.938927889 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:34.173825026 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:34.173933029 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:34.482013941 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:44.578701973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:44.889889956 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:44.890705109 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:45.160501003 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:45.218646049 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:45.458667040 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:45.458743095 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:45.460604906 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:45.485165119 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:45.485223055 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:45.786495924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:45.786556005 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:46.097032070 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:54.360255003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:54.666814089 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:54.666984081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:54.933890104 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:54.982815981 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:55.234421968 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:55.234538078 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:55.235867023 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:55.250744104 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:55.253511906 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:55.542936087 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:55.543050051 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:55.849977970 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:57.250670910 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:57.556868076 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:57.556917906 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:57.823558092 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:57.872514009 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:58.124315977 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:58.124398947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:58.131023884 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:58.138947010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:58.139000893 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:58.441008091 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:30:58.441066027 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:30:58.747658968 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:11.403920889 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:11.711946964 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:11.712960005 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:11.989264965 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:12.044354916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:12.280692101 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:12.282771111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:12.286691904 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:12.343581915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:12.346791029 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:12.592530966 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:12.592590094 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:12.900551081 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:22.482712030 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:22.791609049 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:22.791672945 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.079386950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:23.122133970 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.360295057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:23.360433102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.361974955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.388700008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:23.388755083 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.679272890 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:23.679404020 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:23.988121033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:24.326694965 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:24.633153915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:24.633212090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:24.917454004 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:24.917520046 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:25.184329033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:25.187114954 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:25.470499039 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:25.470608950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:25.777055979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:25.777446032 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:26.084134102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:26.857156992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:27.164640903 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:27.164695024 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:27.431715965 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:27.481523037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:27.731509924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:27.736016035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:27.736016035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:27.751329899 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:27.758725882 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:28.041800976 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:28.041928053 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:28.348067999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:33.388269901 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:33.694211960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:33.694801092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:33.961982965 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:34.013379097 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:34.263704062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:34.266799927 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:34.270720959 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:34.279966116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:34.282789946 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:34.577619076 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:34.577680111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:34.885081053 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:36.530492067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:36.837507010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:36.837554932 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.104456902 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:37.147528887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.404501915 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:37.404587030 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.406265974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.414160967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:37.414230108 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.712403059 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:37.712852955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:37.979746103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:38.028975964 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:38.279867887 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:38.284140110 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:38.284140110 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:38.295636892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:38.301004887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:38.591337919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:38.591470957 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:38.898282051 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:49.646733046 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:49.646768093 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:49.650800943 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:49.654728889 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:49.654750109 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.133238077 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.138735056 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.150732040 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.150752068 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.151169062 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.151731968 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.151731968 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.151827097 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.151854038 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.307645082 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.308872938 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.432149887 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.432250977 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.432440996 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.432552099 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.432552099 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:50.432571888 CEST	443	49758	52.168.112.67	192.168.2.4
Apr 26, 2024 14:31:50.433093071 CEST	49758	443	192.168.2.4	52.168.112.67
Apr 26, 2024 14:31:51.420247078 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:51.726607084 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:51.734761000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.001863003 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:52.046768904 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.301403999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:52.301815987 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.304747105 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.313313961 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:52.313829899 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.612731934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:52.612790108 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:52.919652939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:53.585889101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:53.892712116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:53.893184900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:54.160058975 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:54.216766119 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:54.460659981 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:54.460797071 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:54.462732077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:54.485084057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:54.486893892 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:54.770785093 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:31:54.770848036 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:31:55.078161001 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:00.016745090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:00.324090958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:00.326816082 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:00.593594074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:00.638292074 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:00.893944979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:00.894006968 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:00.895766973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:00.904870987 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:00.904908895 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:01.217928886 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:01.217976093 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:01.528332949 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:06.435652018 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:06.742610931 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:06.742666006 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:07.009499073 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:07.009557962 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:07.276297092 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:07.278188944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:07.544881105 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:07.544959068 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:07.852322102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:07.852835894 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:08.159315109 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:19.404412985 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:19.710381985 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:19.713125944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:19.979763985 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:20.014235020 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:20.280991077 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:20.284996033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:20.552015066 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:20.554837942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:20.821403027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:20.823295116 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:21.129743099 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:21.129812956 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:21.436755896 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:25.497840881 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:25.804896116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:25.806855917 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.074671984 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:26.126781940 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.374005079 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:26.374993086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.378772974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.393389940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:26.394881964 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.685111046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:26.685173035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:26.992319107 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:30.763746023 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.069788933 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:31.069849014 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.336515903 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:31.389535904 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.637188911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:31.642185926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.642185926 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.655905962 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:31.661175013 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:31.949246883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:31.949378967 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:32.256494999 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:44.920391083 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:45.226824045 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:45.226886034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:45.493850946 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:45.542990923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:45.794003963 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:45.794250965 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:45.798857927 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:45.810585976 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:45.810729980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:46.105129004 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:46.105247974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:46.412466049 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:50.498811960 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:50.806196928 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:50.806253910 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.074587107 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:51.117057085 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.373779058 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:51.373944044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.375439882 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.384469986 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:51.384535074 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.681963921 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:32:51.688932896 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:32:51.995145082 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:04.646827936 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:04.953088045 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:04.953154087 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:05.219877005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:05.263029099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:05.519598961 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:05.519669056 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:05.521303892 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:05.529500008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:05.529542923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:05.827578068 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:05.827697992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:06.133990049 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:08.076050997 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:08.382358074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:08.382905960 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:08.649507046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:08.700967073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:08.949029922 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:08.949090958 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:08.950607061 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:08.967556000 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:08.967609882 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:09.257244110 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:09.257307053 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:09.563273907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:10.170866966 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:10.477154970 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:10.478920937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:10.745786905 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:10.791795015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:10.923424006 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.045694113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.045769930 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.045854092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.058198929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.058263063 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.230674028 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.230736971 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.312908888 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.356690884 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.497113943 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.499810934 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.612200975 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.612268925 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:11.806035995 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:11.808949947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:12.116436958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:20.249953032 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:20.556323051 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:20.558885098 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:20.825892925 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:20.873019934 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:21.126066923 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:21.126151085 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:21.129414082 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:21.143655062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:21.143702984 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:21.446207047 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:21.446333885 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:21.753295898 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:23.576845884 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:23.884838104 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:23.885154963 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:24.152677059 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:24.201057911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:24.452014923 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:24.452409029 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:24.453928947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:24.467652082 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:24.467741013 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:24.760360003 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:24.760409117 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:25.066579103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:25.342331886 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:25.654742956 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:25.654860973 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:25.921428919 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:25.966036081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:26.221486092 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:26.221611977 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:26.222955942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:26.232503891 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:26.232639074 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:26.529877901 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:26.529947042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:26.837033987 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:31.576179028 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:31.882189989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:31.882982016 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.149641037 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.202905893 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.342804909 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.449884892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.450898886 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.450973034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.469624996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.470879078 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.650541067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.650990963 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.717509985 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.763127089 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:32.917417049 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:32.919121981 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:33.018182993 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:33.018245935 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:33.225879908 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:33.225929976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:33.532686949 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:46.498872042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:46.805550098 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:46.805620909 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.072477102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:47.123070955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.372351885 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:47.372490883 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.380023003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.389806986 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:47.389867067 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.686528921 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:47.686598063 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:47.993369102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:58.811290026 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.117743015 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:59.117815018 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.385428905 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:59.435502052 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.685463905 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:59.685534000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.687342882 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.702302933 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:59.702357054 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:33:59.994163036 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:33:59.995141983 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:00.302165031 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:00.578927994 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:00.890866995 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:00.890927076 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:01.157531977 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:01.200634003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:01.457232952 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:01.457314968 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:01.459075928 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:01.468534946 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:01.468686104 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:01.778223991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:01.778318882 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:02.085443020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:02.983694077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:03.290318012 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:03.290386915 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:03.557219028 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:03.599150896 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:03.856787920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:03.859025002 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:03.863008976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:03.865680933 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:03.866992950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:04.170047998 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:04.170931101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:04.477380991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:05.435636044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:05.742419004 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:05.742474079 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.009454012 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:06.058900118 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.320725918 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:06.323010921 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.326906919 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.340399027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:06.343350887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.633995056 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:06.634953976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:06.941139936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:14.498287916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:14.804754019 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:14.806648016 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:15.075208902 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:15.122565031 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:15.375463963 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:15.375544071 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:15.377499104 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:15.388997078 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:15.389045954 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:15.685509920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:15.685581923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.006484032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:16.006993055 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.273695946 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:16.326909065 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.573838949 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:16.580280066 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.580281019 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.593466043 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:16.598906040 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:16.888385057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:16.888448000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:17.196691990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:30.155102968 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:30.461183071 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:30.463032007 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:30.731230021 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:30.782919884 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:31.031071901 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:31.031133890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:31.032788038 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:31.049736023 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:31.049784899 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:31.342771053 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:31.342827082 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:31.675721884 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:33.279779911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:33.586015940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:33.586076975 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:33.853029966 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:33.906944990 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.049391985 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.157332897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.161314011 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.161314011 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.175302029 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.181440115 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.356601000 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.356734037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.429569960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.482933044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.626552105 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.630922079 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.729882002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.733148098 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:34.937037945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:34.937099934 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:35.244257927 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:37.655230045 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:37.961564064 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:37.963035107 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:38.250998974 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:38.294949055 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:38.529921055 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:38.530975103 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:38.532480955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:38.561427116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:38.561506033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:38.839884996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:38.840054989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:39.146913052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:50.215018034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:50.523416996 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:50.523502111 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:50.790266991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:50.837955952 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:51.090152979 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:51.090236902 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:51.091593981 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:51.104485989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:51.104531050 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:51.425470114 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:51.426599026 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:51.750540018 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:52.453586102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:52.763292074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:52.763375998 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.046981096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:53.091063976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.334676027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:53.334743977 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.336644888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.357692957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:53.357748985 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.644179106 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:53.644239902 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:53.950237989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:58.283041000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:58.605074883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:58.605340958 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:58.872092009 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:58.920123100 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:59.171235085 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:59.171322107 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:59.182720900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:59.186717033 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:59.186767101 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:59.489409924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:34:59.489479065 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:34:59.800149918 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:07.795264006 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:08.101922989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:08.106987000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:08.397757053 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:08.451056957 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:08.679495096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:08.683037043 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:08.684607983 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:08.722522020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:08.723018885 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.017908096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:09.017971039 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.326406002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:09.326481104 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.593017101 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:09.653980970 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.894494057 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:09.894568920 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.896312952 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:09.920759916 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:09.920818090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:10.206250906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:10.207041979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:10.517847061 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:16.135046959 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:16.443840981 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:16.447058916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:16.714951038 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:16.756249905 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:17.015336990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:17.015433073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:17.017405033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:17.026515007 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:17.026565075 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:17.324109077 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:17.324160099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:17.630935907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:22.218996048 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:22.526174068 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:22.527061939 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:22.804124117 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:22.858979940 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:23.096292019 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:23.096365929 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:23.098472118 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:23.125507116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:23.125555992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:23.405272007 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:23.405328989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:23.712025881 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:36.373435020 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:36.679850101 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:36.681132078 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:36.965748072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:36.965816021 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.220566988 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.232821941 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.232886076 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.392499924 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.495767117 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.495846033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.512589931 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.512656927 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.549052000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.659033060 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.700124025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.762257099 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.762362003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.779006958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.779095888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.815924883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.815980911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:37.815990925 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:37.966487885 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.013314009 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.045553923 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.049441099 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.122201920 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.125488043 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.356362104 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.392172098 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.485452890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.733678102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.738621950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.741226912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.741226912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:38.761502981 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:38.765877962 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.007630110 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.007678986 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.007747889 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.086795092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.274390936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.274487972 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.354130030 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.354192019 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.553380966 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.553442955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.620780945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.620881081 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.682432890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.876415014 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.876513958 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:39.948884964 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:39.948986053 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:40.190371037 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.255917072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.572182894 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.572343111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.572381973 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.572618008 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:40.575894117 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:40.589181900 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:40.855819941 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:40.861310005 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:40.896461964 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:41.168237925 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:41.168313980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:41.435379982 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:41.435482979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:41.703063965 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:41.703171015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:41.978518963 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:41.981770039 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:42.249599934 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:42.250154018 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:42.557032108 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:42.557475090 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:42.864279032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:42.865134954 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:43.131957054 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:43.132040977 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:43.398968935 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:43.399058104 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:43.665664911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:43.665745974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:43.933145046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:43.933250904 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:44.199769020 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:44.203242064 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:44.469820976 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:44.470168114 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:44.736804008 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:44.737124920 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:45.043725967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:45.043795109 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:45.311248064 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:45.311325073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:45.577970028 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:45.578041077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:45.844866037 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:45.844970942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.014018059 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.111474991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.170020103 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.281742096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.287111044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.322065115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.323153019 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.411401987 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.413115978 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.436690092 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.436800003 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.590063095 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:46.593092918 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:46.899641991 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:47.215332031 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:47.504977942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:47.522208929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:47.771691084 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:47.771744013 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:47.771752119 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:47.771796942 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.038464069 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.043025017 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.047013044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.310177088 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.310360909 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.313541889 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.313700914 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.354588032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.354873896 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.619683027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.619966984 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:48.661700010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:48.887851954 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.016793013 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.073823929 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.187879086 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.187944889 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.187968016 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.283817053 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.283870935 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.379730940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.379785061 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.481986046 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.482048035 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.646267891 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.646332026 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.748516083 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.748580933 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:49.913220882 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:49.913296938 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.030699968 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.030973911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.179886103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.181137085 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.308816910 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.447688103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.453115940 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.598634005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.605169058 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.719890118 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.725063086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:50.991569042 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:50.993884087 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:51.300075054 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:51.300134897 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:51.578775883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:51.578847885 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:51.845956087 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:51.846040964 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:52.121378899 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:52.129162073 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:52.396904945 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:52.397100925 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:52.677118063 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:52.677324057 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:52.984222889 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:52.984287024 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:52.989074945 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.250827074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.250972986 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.256159067 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.517704010 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.517781019 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.628782034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.784239054 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.784337044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.836072922 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.906848907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.906945944 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:53.935761929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:53.935818911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.050868988 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.102569103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.103261948 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.176950932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.179061890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.202318907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.205486059 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.369920015 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.373359919 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.472007990 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.473268032 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.640161037 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.640584946 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:54.739814043 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.907788038 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:54.911051989 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:55.177599907 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:55.177669048 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:55.444381952 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:55.444503069 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:55.711471081 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:55.712229013 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:55.979302883 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:55.979439974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:56.246619940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:56.247145891 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:56.514197111 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:56.515728951 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:56.782341003 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:56.783122063 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:57.050088882 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:57.050170898 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:57.316953897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:57.317183971 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:57.584042072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:57.584181070 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:57.850790024 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:57.850907087 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:58.139224052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:58.143140078 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:58.409893036 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:58.410100937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:58.676533937 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:58.679119110 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:58.946825981 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:58.947134972 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.213766098 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:59.213826895 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.473126888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.480427027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:59.480498075 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.740258932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:59.740433931 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.747033119 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:35:59.747198105 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:35:59.971570969 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:00.008117914 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.013735056 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.015187025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:00.239072084 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.239170074 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.243196964 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:00.282344103 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.287074089 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:00.552741051 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.554554939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.554775953 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:00.864150047 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:00.867125988 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.135894060 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.209856033 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.356493950 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.434232950 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.434308052 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.434372902 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.476550102 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.476599932 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.664752960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.664815903 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.701102972 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.779047012 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:01.932058096 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:01.932147980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.001699924 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.001773119 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.001802921 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.045691967 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.049460888 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.238311052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.241466999 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.269696951 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.269753933 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.482439041 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.549082041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.549452066 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.568694115 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.568821907 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.761323929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.761512995 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:02.856766939 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:02.857101917 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.165067911 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.165134907 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.412070036 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.431969881 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.432039976 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.678822041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.678957939 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.698839903 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.698930025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.850497007 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:03.946316004 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.966552019 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:03.966625929 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.124161005 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.124223948 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.125277996 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.233130932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.279190063 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.391736984 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.391896963 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.534531116 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.537132025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.545542002 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.549458027 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:04.698626041 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:04.701195002 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:05.007806063 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:05.143394947 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:05.448980093 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:05.449040890 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:05.715751886 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:05.715903044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:05.988307953 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:05.988476992 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:06.255398989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:06.257158995 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:06.523999929 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:06.525785923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:06.792748928 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:06.792893887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.099225998 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.099325895 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.376672029 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.405586958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.405644894 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.643798113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.643866062 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.643868923 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.672383070 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.672442913 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.717170000 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.911941051 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.912045002 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.944943905 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.945008993 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:07.986865997 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.986906052 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:07.986938953 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.178621054 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.181287050 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.211786032 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.213399887 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.253475904 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.253931046 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.480436087 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.481878042 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.560935974 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.563190937 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.748867989 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.829909086 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:08.833688974 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:08.837034941 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.048940897 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.049025059 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.049025059 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.100298882 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.100357056 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.143986940 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.144042015 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.356566906 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.356637955 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.410872936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.548991919 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.623258114 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.624016047 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.711366892 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.711513996 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.715040922 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.815747023 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.815805912 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:09.929972887 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:09.930030107 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:10.021322012 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:10.236558914 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:10.395308018 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:10.701937914 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:10.702064037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:10.968784094 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.093543053 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.117806911 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.268201113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.268266916 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.268326998 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.360094070 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.360146999 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.424171925 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.424226046 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.535064936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.535130978 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.690778017 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.690855980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.801846027 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.801920891 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:11.958048105 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:11.958103895 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.068439960 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.071156979 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.224633932 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.227229118 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.337819099 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.339137077 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.533694983 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.535077095 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.605726957 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.669950008 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.801542044 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.807156086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:12.905690908 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:12.909235954 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:13.073992014 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:13.081480980 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:13.348273993 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:13.348352909 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:13.617192984 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:13.617300034 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:13.884629011 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:13.884732008 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:14.151618958 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:14.153249025 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:14.420308113 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:14.421348095 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:14.728518009 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:14.729176044 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:15.035742998 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:15.037177086 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:15.304543018 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:15.304625988 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:15.571651936 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:15.571727037 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:15.838782072 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:15.838874102 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:16.105998993 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:16.107405901 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:16.375035048 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:16.375770092 CEST	49730	3323	192.168.2.4	94.156.128.246
Apr 26, 2024 14:36:16.642517090 CEST	3323	49730	94.156.128.246	192.168.2.4
Apr 26, 2024 14:36:16.642818928 CEST	49730	3323	192.168.2.4	94.156.128.246

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:27:06.750335932 CEST	61046	53	192.168.2.4	1.1.1.1
Apr 26, 2024 14:27:06.750540972 CEST	59278	53	192.168.2.4	1.1.1.1
Apr 26, 2024 14:27:06.820163012 CEST	53	58706	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:06.840818882 CEST	53	57948	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:06.875777960 CEST	53	61046	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:06.876178026 CEST	53	59278	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:09.198625088 CEST	53	55198	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:19.447828054 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 14:27:28.950972080 CEST	53	53932	1.1.1.1	192.168.2.4
Apr 26, 2024 14:27:47.874293089 CEST	53	50633	1.1.1.1	192.168.2.4
Apr 26, 2024 14:28:06.236802101 CEST	53	52504	1.1.1.1	192.168.2.4
Apr 26, 2024 14:28:11.435713053 CEST	53	49604	1.1.1.1	192.168.2.4
Apr 26, 2024 14:28:36.451692104 CEST	53	59857	1.1.1.1	192.168.2.4
Apr 26, 2024 14:29:21.684812069 CEST	53	51575	1.1.1.1	192.168.2.4
Apr 26, 2024 14:30:36.327503920 CEST	53	58528	1.1.1.1	192.168.2.4
Apr 26, 2024 14:31:20.082705021 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 14:32:52.014436007 CEST	53	54751	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 14:27:06.750335932 CEST	192.168.2.4	1.1.1.1	0x985d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:27:06.750540972 CEST	192.168.2.4	1.1.1.1	0x93e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 14:27:06.875777960 CEST	1.1.1.1	192.168.2.4	0x985d	No error (0)	www.google.com	142.250.64.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:27:06.876178026 CEST	1.1.1.1	192.168.2.4	0x93e	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 26, 2024 14:27:07.306252956 CEST	1.1.1.1	192.168.2.4	0x8b0e	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:27:07.306252956 CEST	1.1.1.1	192.168.2.4	0x8b0e	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

self.events.data.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:07 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:27:07 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:27:07 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-LVJXr2q2UVV_Gw0Tr5iRUw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 12:27:07 UTC	1703	IN	Data Raw: 31 38 65 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 61 69 67 65 20 62 75 65 63 6b 65 72 73 22 2c 22 6e 61 73 61 20 61 72 74 65 6d 69 73 20 73 70 61 63 65 20 6c 61 75 6e 63 68 20 73 79 73 74 65 6d 22 2c 22 6d 6f 64 65 72 6e 20 68 6f 72 69 7a 6f 6e 73 20 33 20 63 6f 6d 6d 61 6e 64 65 72 20 64 65 63 6b 73 20 6c 65 61 6b 73 22 2c 22 6e 61 73 61 20 6d 61 72 73 20 73 70 69 64 65 72 73 22 2c 22 6d 6f 75 6c 69 6e 20 72 6f 75 67 65 20 77 69 6e 64 6d 69 6c 6c 20 73 61 69 6c 73 22 2c 22 63 6c 65 61 72 20 61 69 72 70 6f 72 74 20 73 65 63 75 72 69 74 79 20 63 61 6c 69 66 6f 72 6e 69 61 22 2c 22 62 65 61 72 73 20 6e 66 6c 20 64 72 61 66 74 20 70 69 63 6b 73 22 2c 22 63 68 61 6c 6c 65 6e 67 65 72 73 20 6d 6f 76 69 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: 18e1)]}'["",["paige bueckers","nasa artemis space launch system","modern horizons 3 commander decks leaks","nasa mars spiders","moulin rouge windmill sails","clear airport security california","bears nfl draft picks","challengers movie"],["","","","","
2024-04-26 12:27:07 UTC	1703	IN	Data Raw: 4d 56 46 70 55 55 56 31 51 55 31 71 65 6a 52 71 64 33 46 58 5a 7a 68 78 53 45 56 53 51 33 55 33 63 58 68 46 5a 47 31 30 65 6b 68 71 59 56 52 34 4d 6a 68 6f 62 6b 39 6a 5a 6b 56 49 4e 56 56 42 59 56 6b 32 55 47 51 35 63 54 42 6c 52 30 64 55 53 45 56 48 54 44 51 30 57 43 74 52 56 46 46 43 53 47 35 54 4f 57 73 76 53 6d 31 4b 4b 30 6c 6c 4f 46 70 70 4b 32 55 77 64 32 68 48 57 6b 5a 49 62 57 46 75 5a 47 46 73 4e 6a 4d 72 63 45 39 71 55 32 5a 77 61 6d 4e 4c 4d 79 74 31 55 48 5a 57 52 45 63 30 55 57 78 36 65 56 46 46 62 58 56 69 4f 55 6f 35 56 47 78 30 4f 57 5a 54 4f 47 70 33 65 6c 49 30 59 6b 49 34 59 54 52 59 63 47 77 30 51 7a 59 79 55 57 68 77 53 7a 5a 61 5a 6a 49 72 62 6e 70 32 53 6a 4a 72 53 31 5a 52 61 32 4a 7a 62 6d 77 34 53 33 68 7a 63 6d 30 78 59 54 4a Data Ascii: MVFpUUV1QU1qejRqd3FXZzhxSEVSQ3U3cXhFZG10ekhqYVR4Mjhobk9jZkVINVVBYVk2UGQ5cTBlR0dUSEVHTDQ0WCtRVFFCSG5TOWsvSm1KK0llOFppK2Uwd2hHWkZIbWFuZGFsNjMrcE9qU2ZwamNLMyt1UHZWREc0UWx6eVFFbXViOUo5VGx0OWZTOGp3elI0YkI4YTRYcGw0QzYyUWhwSzZaZjIrbnp2SjJrS1ZRa2Jzbmw4S3hzcm0xYTJ
2024-04-26 12:27:07 UTC	1703	IN	Data Raw: 51 55 46 42 51 55 46 42 51 55 46 42 52 6b 4a 6e 53 55 52 43 51 57 4e 43 4c 7a 68 52 51 55 35 53 51 55 46 42 5a 30 56 45 51 57 64 52 52 45 4a 52 59 30 56 42 64 30 46 42 51 55 46 42 51 55 46 52 53 55 52 43 51 56 56 53 51 55 4e 46 52 30 56 71 52 6b 4a 46 65 55 70 6f 56 56 68 48 51 6d 39 6b 52 56 56 47 55 30 31 35 56 58 42 48 65 47 4e 7a 53 46 4d 30 55 57 4e 58 61 33 59 76 52 55 46 43 5a 30 4a 42 51 55 31 43 51 56 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 52 55 52 43 51 55 6c 42 4c 7a 68 52 51 55 6c 34 52 55 46 42 5a 30 6c 44 51 56 46 4a 53 45 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 52 53 55 46 46 55 55 31 6f 54 56 4a 4d 64 30 4a 43 54 57 6c 52 56 6b 5a 6f 61 32 59 76 59 55 46 42 64 30 52 42 55 55 46 44 52 56 46 4e 55 6b 46 Data Ascii: QUFBQUFBQUFBRkJnSURCQWNCLzhRQU5SQUFBZ0VEQWdRREJRY0VBd0FBQUFBQUFRSURCQVVSQUNFR0VqRkJFeUpoVVhHQm9kRVVGU015VXBHeGNzSFM0UWNXa3YvRUFCZ0JBQU1CQVFBQUFBQUFBQUFBQUFBQUFBRURCQUlBLzhRQUl4RUFBZ0lDQVFJSEFBQUFBQUFBQUFBQUFRSUFFUU1oTVJMd0JCTWlRVkZoa2YvYUFBd0RBUUFDRVFNUkF
2024-04-26 12:27:07 UTC	1268	IN	Data Raw: 71 64 48 42 6d 64 58 70 57 56 56 6f 31 4e 6b 59 78 56 31 56 71 51 6a 56 6f 61 30 56 68 52 31 55 78 65 58 49 32 54 57 73 7a 55 30 70 77 53 53 73 77 62 45 39 76 56 6d 78 51 64 54 4a 43 53 44 64 68 64 7a 4a 52 63 32 4a 4e 4d 56 46 78 62 7a 55 34 55 58 64 79 56 58 4a 6f 55 55 64 42 4d 48 45 77 62 47 52 6a 54 30 4d 31 52 6c 4a 76 64 6e 52 47 63 48 46 49 53 6c 64 49 55 47 31 6f 59 6e 5a 35 4b 32 35 77 63 54 52 59 56 33 46 79 64 6b 35 69 59 57 52 31 56 57 4a 6a 4f 56 4e 34 65 56 51 76 51 55 56 78 5a 6a 63 32 4d 31 45 79 4e 6e 42 79 4e 46 46 69 64 56 56 61 5a 30 35 73 57 45 39 43 4b 79 74 70 62 56 46 78 57 55 4e 43 56 6b 64 69 52 48 68 6f 57 6e 46 70 62 46 6f 77 63 55 56 71 62 44 56 54 56 6d 70 75 57 47 78 69 54 30 35 32 56 48 4a 77 5a 57 64 78 4e 31 5a 55 56 44 Data Ascii: qdHBmdXpWVVo1NkYxV1VqQjVoa0VhR1UxeXI2TWszU0pwSSswbE9vVmxQdTJCSDdhdzJRc2JNMVFxbzU4UXdyVXJoUUdBMHEwbGRjT0M1RlJvdnRGcHFISldIUG1oYnZ5K25wcTRYV3Fydk5iYWR1VWJjOVN4eVQvQUVxZjc2M1EyNnByNFFidVVaZ05sWE9CKytpbVFxWUNCVkdiRHhoWnFpbFowcUVqbDVTVmpuWGxiT052VHJwZWdxN1ZUVD
2024-04-26 12:27:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:07 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:27:08 UTC	1816	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgRmgZjcGJu7rrEGIjBz-A03yBb_l6_skdCIaOp-TsMG5aqdZbNuLgWbV6Yq21RAyguYxGQ5BILyukf0IjEyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIm7uusQYQwsDqzAMSBGaBmNw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 12:27:07 GMT Server: gws Content-Length: 427 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-12; expires=Sun, 26-May-2024 12:27:07 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=Xlp7R-bmsmNOj3b4ZVqsNM2Kwsog6kgc534mWRQgEFng8z4pjzwLPyOrOp_zv4dqIVC31XxV8GBI4zUW2B9ZaeTpRv4En2s7SqgdCasESfWltA8N0-ANMkOmpdCZlvesX1LfiRNUAnKJCkwcPWMNbssxB6HFFJstvVr8VW2mIfU; expires=Sat, 26-Oct-2024 12:27:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:27:08 UTC	427	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 64 64 6c 6a 73 6f 6e 25 33 46 61 73 79 6e Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasyn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:07 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:27:08 UTC	1842	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGJu7rrEGIjDDcv02CuPdWY5ubddYolN9oRq8ljClcTTSomnqqiNV12SKZZRW_Od0MHXrWW8249YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsInLuusQYQy5mMNBIEZoGY3A Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 12:27:08 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-12; expires=Sun, 26-May-2024 12:27:08 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=ajmUOexKwGMh0AvseEoWnqvqvcnjinuBPSdrVSftflPccZwEDAhTnWaTaY0UcGkJWJwwLniKDkt6ugI1rLHDeVR4Ks1DuZUZDuWm9lIyv24LXQCiHULnjblafcAxqSR7bwKUIInEF3BIYHF7fOTdyu4xbWUfEWcX0pr572m3BSY; expires=Sat, 26-Oct-2024 12:27:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:27:08 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49732	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:07 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:27:07 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGJu7rrEGIjAoqyexFOGLbT8aLOaA_R2zVcAlbcD7V11k6B8b8yEPzaS9F1blMUQnJ9DYpXZ_bH4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIm7uusQYQupHMlAMSBGaBmNw Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 12:27:07 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-12; expires=Sun, 26-May-2024 12:27:07 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=NkiFAXgSKA3Tdq3907kJrIQfTUK6x9O4XZOwzEH1699a56lucUmfepjqh8DTNIvSYWCy5PDPwFb27pos2DjJwQCiDTsPtdS0jL-OHQeEpZyNQJ2YGeHy0PLevxOX7zV_Ei4j9APbTzCU6bK43PGHaHU2pUUxXVyvfa3w8237Coo; expires=Sat, 26-Oct-2024 12:27:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:27:07 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:09 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGJu7rrEGIjAoqyexFOGLbT8aLOaA_R2zVcAlbcD7V11k6B8b8yEPzaS9F1blMUQnJ9DYpXZ_bH4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-12; NID=513=ajmUOexKwGMh0AvseEoWnqvqvcnjinuBPSdrVSftflPccZwEDAhTnWaTaY0UcGkJWJwwLniKDkt6ugI1rLHDeVR4Ks1DuZUZDuWm9lIyv24LXQCiHULnjblafcAxqSR7bwKUIInEF3BIYHF7fOTdyu4xbWUfEWcX0pr572m3BSY
2024-04-26 12:27:09 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 12:27:09 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3114 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:27:09 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 12:27:09 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 51 6b 62 4e 4b 48 5a 2d 62 74 78 33 31 52 76 4e 30 76 36 4d 79 43 59 74 30 50 6d 76 54 33 65 57 5f Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="QkbNKHZ-btx31RvN0v6MyCYt0PmvT3eW_
2024-04-26 12:27:09 UTC	960	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	142.250.64.196	443	6732	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:09 UTC	912	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGJu7rrEGIjDDcv02CuPdWY5ubddYolN9oRq8ljClcTTSomnqqiNV12SKZZRW_Od0MHXrWW8249YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-12; NID=513=ajmUOexKwGMh0AvseEoWnqvqvcnjinuBPSdrVSftflPccZwEDAhTnWaTaY0UcGkJWJwwLniKDkt6ugI1rLHDeVR4Ks1DuZUZDuWm9lIyv24LXQCiHULnjblafcAxqSR7bwKUIInEF3BIYHF7fOTdyu4xbWUfEWcX0pr572m3BSY
2024-04-26 12:27:09 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 12:27:09 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3186 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:27:09 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 12:27:09 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 46 33 37 6f 53 5f 48 36 6b Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="F37oS_H6k
2024-04-26 12:27:09 UTC	1032	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 12:27:19 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=67033 Date: Fri, 26 Apr 2024 12:27:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 12:27:19 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=67046 Date: Fri, 26 Apr 2024 12:27:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 12:27:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E+L9AauZ856Cb3R&MD=8gCfUGcc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 12:27:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d0f094a4-75ba-4f6b-be75-831bba1ed4d2 MS-RequestId: 48854db6-ca5c-4db0-84cc-d1486e01bb10 MS-CV: IIZrOuvU9US/+hVE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 12:27:19 GMT Connection: close Content-Length: 24490
2024-04-26 12:27:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 12:27:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:27:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E+L9AauZ856Cb3R&MD=8gCfUGcc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 12:28:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 2e35df44-35cd-4c6e-bf35-889c7ead4014 MS-RequestId: c335bc4f-5fc6-4f25-be45-ae60ea08bf78 MS-CV: 3C9PGbQAw0ijYpVe.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 12:27:59 GMT Connection: close Content-Length: 25457
2024-04-26 12:28:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 12:28:00 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49758	52.168.112.67	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:31:50 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1714134708629 Host: self.events.data.microsoft.com Content-Length: 7976 Connection: Keep-Alive Cache-Control: no-cache
2024-04-26 12:31:50 UTC	7976	OUT	Data Raw: ed 7c 5b ac 1c 47 7a 5e 53 92 19 8a a2 28 ae a4 d5 4a 5a 79 45 13 da cd ca 9a 39 a9 fb 65 10 c3 4b 1d 9e 5d 71 23 2e 15 1e 4a da 5d c0 60 7a 66 7a 66 9a 9c 99 3e 9a 0b 2f 82 1f 84 45 60 c0 41 6c 84 06 02 18 7e 5a f8 21 b0 00 db 08 02 e7 21 7e f2 43 1e b2 a1 61 20 c8 a3 f3 90 04 c8 4b 90 07 23 48 f2 e2 20 c8 57 d5 d5 dd 35 c5 23 ee 7a b1 10 bc 00 0f 48 1e fe 55 d5 75 fd ff ef ff fe aa ea 7e f3 49 be 47 2e 8b ab 93 49 39 2a 6e 1c de 5b 6f 8a 45 f8 f5 4e 91 cf 37 b3 2b c5 26 1f e7 9b fc 52 71 1b 25 f6 ab e5 ba 9a 97 48 28 c6 1f fd ee 1f fe bf bf f8 c7 7f fd af fe d3 17 3e bd 50 0d 46 63 c3 95 62 4a 51 3a 12 a3 3c cf cd 64 24 87 ac d0 cc 14 85 a1 e3 ff 70 f2 07 4f 3d f8 e2 e9 13 e5 99 0f ae dc c9 57 45 ef fc e5 e5 68 ef 37 4f d7 12 23 3d 9a 3d 78 e9 f4 89 ec Data Ascii: \|[Gz^S(JZyE9eK]q#.J]`zfzf>/E`Al~Z!!~Ca K#H W5#zHUu~IG.I9*n[oEN7+&Rq%H(>PFcbJQ:<d$pO=WEh7O#==x
2024-04-26 12:31:50 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-26 12:31:50 UTC	443	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 1595 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Fri, 26 Apr 2024 12:31:49 GMT Connection: close {"acc":4}

Target ID:	0
Start time:	14:26:59
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\ePI4igo4y1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ePI4igo4y1.exe"
Imagebase:	0x6f0000
File size:	75'776 bytes
MD5 hash:	76935BFC6A1783AE507F5AF7BB7A5691
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1696607809.00000000006F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:27:04
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:27:04
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,4947626736655423658,5044590235731121884,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ePI4igo4y1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmp8834.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8864.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8876.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8896.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8A2D.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8A4E.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8B39.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8B4A.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8B4B.tmp.dat

Windows Analysis Report
ePI4igo4y1.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre